If you want to make it more secure you should pass the variables through these functions to make it safer: //input: $varname //strip html tags $_2ndvarname = strip_tags($varname); //strip slashes $finalvarname = stripslashes($_2ndvarname); //safe output: $finalvarname
function clean($input){ return str_replace(array("content-type", "bcc:", "to:", "cc:", "href"), "", strip_tags($input)); } PHP: