What are common mistakes to avoid when using PHP variables in email subjects?

When using PHP variables in email subjects, it is important to ensure that the variables are properly sanitized to prevent any potential security vulnerabilities such as injection attacks. One common mistake to avoid is directly inserting user input into the email subject without validating or escaping it. To prevent this, always use functions like htmlspecialchars() or htmlentities() to sanitize the variables before including them in the email subject.

// Example of properly sanitizing PHP variables in email subjects
$subject = "New message from " . htmlspecialchars($user_name);