title: Is "strip_tags" sufficient for contact form security?
body: <p>I've got a contact form on my website, which submits the post value of the user's name, email address, subject, and message, to a function that sends the email using phpmailer. Is using strip_tags sufficient to make this form secure? I haven't implemented this yet.</p>
  
  <pre><code>function sendEmail($mail, $to, $subject, $senderName, $from, $message) {
      if((!empty($to)) &amp;&amp; (!empty($subject)) &amp;&amp; (!empty($senderName)) &amp;&amp; (!empty($from)) &amp;&amp; (!empty($message))) {
          $mail-&gt;isSMTP();                                      // Set mailer to use SMTP
          $mail-&gt;Host = '[REDACTED]';  // Specify main and backup SMTP servers
          $mail-&gt;SMTPAuth = true;                               // Enable SMTP authentication
          $mail-&gt;Username = '[REDACTED]';                 // SMTP username
          $mail-&gt;Password = '[REDACTED]';                           // SMTP password
          $mail-&gt;SMTPSecure = 'tls';                            // Enable TLS encryption, `ssl` also accepted
          $mail-&gt;Port = 587;                                    // TCP port to connect to
  
          $mail-&gt;setFrom($from, $senderName); //
          $mail-&gt;addAddress('[REDACTED]', '[REDACTED]');     // Add a recipient. Hardcoded email address
          $mail-&gt;addReplyTo($from, $senderName);
  
          $mail-&gt;Subject = $subject;
          $mail-&gt;Body    = "&lt;h1&gt;You've received a message through the contact form at chriscomposes.com&lt;/h1&gt;&lt;br&gt;&lt;br&gt;" . $message;
          $mail-&gt;AltBody = "You've received a message through the contact form at chriscomposes.com." . $message;
  
          if(!$mail-&gt;send()) {
              return "&lt;p style='margin-left: 5px; color: red;'&gt;Message failed to send.&lt;/p&gt;";
          } else {
              return "&lt;p style='margin-left: 5px; color: green;'&gt;Message has been sent.&lt;/p&gt;";
          }   
      } else {
          return "&lt;p style='margin-left: 5px; color: red;'&gt;One or more fields are empty. Please enter a subject, name, email address, and message.&lt;/p&gt;";
      }
  } 
  </code></pre>
  
  <p>^ That is the function it runs. With the hardcoded email address, I don't think it would be vulnerable to someone using the form to send emails with. One other concern is that the user receiving the address would be vulnerable to javascript inserted into the email.</p>
  
  <p>This is the form: <a href="https://i.stack.imgur.com/HGyXE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/HGyXE.png" alt="enter image description here"></a></p>
  
  <p>Then it posts with this: <code>sendEmail($mail, $contactEmail, $_POST['subject'], $_POST['sender_name'], $_POST['sender_email'], $_POST['body']);</code> with $contactEmail being an address pulled from my database. Then that function sends the email address using phpmailer.</p>