You need to URL-encode SEARCHED_QUERY_HERE
, otherwise if a user searches for &body=something
, the body of the e-mail message will be set to something
. Also, if you don't URL-encode it, if the user searches for a literal %20
(or similar) it will appear as a space in the message instead.
This is not a security risk, though.
The other, obvious risk is that if you don't properly HTML-encode the SEARCHED_QUERY_HERE
, it will lead to XSS. But it appears you're already doing so, so you're covered.
Some programming languages, such as PHP, require you to explicitly specify that quotes must be encoded as well, so make sure you pass the correct arguments to your HTML-encoding function.
Example (PHP)
echo '<a href="mailto:[email protected]?subject='.htmlspecialchars(rawurlencode(SEARCHED_QUERY_HERE), ENT_QUOTES, 'utf-8') .'>Link</a>';