Message input field validation

Question

Really new to this PHP validation

So I am trying to submit a contact form, I am able to validate all the other field expect the message(Textarea) input field. I have been trying to input into the field as <h1>Hello</h1> and the HTML tags are able to get through and in the email, the message part is shown/displayed in h1 format.

Input Field

[1]https://imgur.com/QEJlPvw

Email that was sent

[2]https://imgur.com/ypN4rVu

Is it because I am sending the information from the fields using to the email using the HTML markup?

I have tried using the PHP function that removes the special characters.

if (trim($_POST["message"]) == "") {
    $message_error = "Your message should not be empty";
  } else {
    $message = test_input($_POST["message"]);
  }

function test_input($data) {
  $data = trim($data);
  $data = stripslashes($data);
  $data = htmlspecialchars($data);
  return $data;

 if ($name_error == '' and $email_error == '' and $phone_error == '' and $message_error ==''){
      $message_body = '';
      unset($_POST['submit']);
        $name = $_POST['name'];
        $email = $_POST['email'];
        $phone = $_POST['phone'];
        $message = $_POST['message'];
        $to = ' ';
        $subject = "Contact";
        $body = '<html>
                <body>
                    <h1>Message from Contact Us</h1>
                    <hr>
                    <p>Name:<br>'.$name.'</p>
                    <p>Email:<br>'.$email.'</p>
                    <p>Phone Number:<br>'.$phone.'</p>
                    <p>Message:<br>'.$message.'</p>
                </body>
            </html>';
        //header
    $headers = "Content-type: text/html; charset-utf8";


      $to = '';
      $subject = 'Contact Form Submit';
      if (mail($to, $subject, $body, $headers)){
          $success = "Message sent, Thank you for contacting us!";
          $name = $email = $phone = $message = '';
      }
  }

}

I expect to have the textarea (message) to strip/remove the HTML tags before sending.

Thanks for helping

you want <h1>Hello</h1> like hello without the html tag? — Dean
@dean basically I don't want anyone to use that as means of XSS attack, so I want to strip everything from the comment section that is code — Pruthvi Diu

nietzscheund nietzscheund · Accepted Answer · 2019-09-06T22:15:27

You can use strip_tags() function:

strip_tags ( string $str [, string $allowable_tags ] ) : string

example:

$text = '<p>Test paragraph.</p><!-- Comment --> <a href="#fragment">Other text</a>';
echo strip_tags($text);

The above example will output:

Test paragraph. Other text

Message input field validation

1 Answers