Prevent Links in Text Fields to Foil Spammers

Your application most likely sends email—in the form of invites, notifications, or forgotten password reminders—even if that is not a primary function of the product.As soon as you allow user-generated content in those emails, your application becomes an interesting target for email spammers. This is due to these nefarious people, and their robot armies, abusing the free text you allow legitimate users to enter.Email clients like Apple Mail and Gmail automatically highlight strings of text that look like web addresses, so by simply inserting strings that resemble web addresses, hackers can use text fields to direct users to nefarious websites. They don’t even have to inject HTML.