What are some common mistakes to avoid when using PHP to pass data in email subjects?

One common mistake to avoid when using PHP to pass data in email subjects is not properly sanitizing the input data, which can lead to security vulnerabilities such as email header injection. To prevent this, always use the `htmlspecialchars()` function to escape special characters in the data before including it in the email subject.

// Sanitize input data for email subject
$email_subject = htmlspecialchars($_POST['subject']);

// Send email with sanitized subject
mail('recipient@example.com', $email_subject, 'Message body', 'From: sender@example.com');