title: Python smtplib and sanitization
body: <p>I'm using a very basic (almost exactly <a href="https://docs.python.org/2/library/email-examples.html" rel="nofollow">from the docs</a>) utilization of smtplib. A subject and message are retrieved from a <a href="http://bottlepy.org/docs/0.12/api.html#bottle.FormsDict" rel="nofollow">Bottle FormsDict</a> using <code>request.forms.get()</code> and then emailed off using this code.</p>
  
  <pre><code>msg = MIMEText(message)
  msg['Subject'] = subject
  msg['From'] = config['from_email']
  msg['To'] = config['to_email']
  s = smtplib.SMTP('localhost')
  s.sendmail(config['from_email'], [config['to_email']], msg.as_string())
  s.quit()
  </code></pre>
  
  <p>I'm used to sanitizing user input for XSS and such (usually just relying on Jinja2's magic). What should I be doing in this case though, where I'm only sending the user's input through email? What sort of vulnerabilities would there be?</p>