When sending emails in the context of an application that will send transactional or marketing emails, sometimes you want to include user-provided information in the body, like for example you ask the user for their name and you send an email with "Hi
An attacker could say their name is
https://evil.com and my emails now contain links to a malicious site. Yay!
However, I'm wondering why this happens. When sending HTML-based email, I'm sending this as text (in a
div or something), not as a hyperlink. But email clients seem to ignore this and convert anything that looks like a link into a link. I checked the received email source, and it's definitely not a link.
So I'm wondering:
- Why do email clients do this? I guess for usability, but doesn't this put their users at risk? I would say if email senders want to make something a link, they will.
- Is there some way to tell the email recipient "no, this is definitely not a link"?