A website I'm working on needs to have a form for any visitor to submit a request for information about a service. The user will not need to create an account, and contact details are just part of the form. The user can also enter a free form message. This information is to be forwarded to someone non-technical who will contact them about buying services. (So yes, this is pretty much marketing stuff.)

My concern is that the user could enter something malicious. Obviously, I can do some things to mitigate if they try to enter HTML or JavaScript (e.g., escaping the content), but what if they just enter a URL? Some e-mail clients (e.g., Outlook) automatically convert URLs into clickable links even if the e-mail was sent as plain text. Is there any standard technical practice I can implement to protect the recipient of this info from blindly clicking it and winding up on a malicious site? Or do I have to rely on the user's Junk Mail filter and judgement (possibly augmented with training)?

A point of clarification: this app is being built as contract work, so we have pretty much no control over the e-mail systems of the people who would receive these requests.


1 Answer 1


Before the email is sent, you can grab all URLs with a regexp, and then submit them to Googles Safe Browsing API to check if they are known to be malicious. If so, just don't send the email or include a warning.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.