Supposing that the user has the power to include any content after
mailto: snippet, are there any possible security vulnerabilities?
The user says their email address is foo. The link on the page (which is visible to everyone), will be be:
I'm interested to know if there is a way to exploit this thing.