So, I'm expending this email submission form script for a client and saw something rather strange to my experience. As you can see below, the original programmer has sanitised the user input. Is this a good practice or does this makes sense at all?
// Build Message Body from Web Form Input foreach ($_POST as $Field=>$Value) $MsgBody .= "$Field: $Value\n"; $MsgBody .= "\n" . @gethostbyaddr($_SERVER["REMOTE_ADDR"]) . "\n" . $_SERVER["HTTP_USER_AGENT"]; $MsgBody = htmlspecialchars($MsgBody, ENT_NOQUOTES); //make safe