K
Kokon B
Guest
You should not allow to user really format the text. You should do it yourself. Use the command nl2br (in php) - it change the text from new line to <br> tag. That is what you can do. You should take away from $_POST['message'] all tags or make a htmlentities() with it. It is a safe way to send the html email without attachments etc.