Currently I am using
htmlspecialchars to sanitise string data from forms. The data is being forwarded to clients in emails, not entered into a database.
I am considering changing to use just:
I quite like that
FILTER_SANITIZE_STRING completely removes any HTML tags whereas with
htmlspecialchars my clients would see some gobbledygook in received emails and would still see the code within HTML tags.
It’s puzzling as to why use of PHP filters to sanitise strings is not more frequently recommended. Is using