title: PHP Code Injection
body: <p>I have a php script running on my web site that accepts user-supplied input to send via an email.  I am sanitizing the input data by stripping tags and slashes.  However, I am not using this input to enter data in a database, or do an include, or an exec, or an eval, or anything like that.  If I'm not doing one of these risky things, is it possible for a malicious user to inject executable php code through the GET, POST, or COOKIES arrays? I'm almost positive that the answer is "no", but I figured it was worth a shot at asking more experienced people.  :)</p>