I use a PHP script which performs a database search and when no result are found, user is presented with a mailto link with this format

mailto:[email protected]?subject=SEARCHED_QUERY_HERE

The SEARCHED_QUERY_HERE is replaced with the search team that user searched which returned no result, Can anyone exploit it? (i encode SEARCHED_QUERY_HERE)

  • What function do you use to encode SEARCHED_QUERY_HERE?
    – Denis
    Jun 6, 2015 at 12:59

3 Answers 3


This could conceivably be abused for HTML injection. Imagine if a user searched for the term

waterfall</a><a href="http://maliciouslink.com">Click Here

The </a> in the search term would terminate the mailto link, and then insert a second link with the words "Click Here".

URL encoding will of course mitigate this problem.

Also, make sure you validate the search query before the database query, as well - otherwise, it could be abused in a similar fashion for SQL injection.


You need to URL-encode SEARCHED_QUERY_HERE, otherwise if a user searches for &body=something, the body of the e-mail message will be set to something. Also, if you don't URL-encode it, if the user searches for a literal %20 (or similar) it will appear as a space in the message instead.

This is not a security risk, though.

The other, obvious risk is that if you don't properly HTML-encode the SEARCHED_QUERY_HERE, it will lead to XSS. But it appears you're already doing so, so you're covered.

Some programming languages, such as PHP, require you to explicitly specify that quotes must be encoded as well, so make sure you pass the correct arguments to your HTML-encoding function.

Example (PHP)

echo '<a href="mailto:[email protected]?subject='.htmlspecialchars(rawurlencode(SEARCHED_QUERY_HERE), ENT_QUOTES, 'utf-8') .'>Link</a>';

I don't think so, but the greater concern is that you're allowing user input to modify the returned page. Make sure you're using a good API for validating user input (as it is used to generate the query) and that you are properly protecting the output in this page. Use OWASP's ESAPI if possible.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .