It depends on the mail backend you are using. DefaultMailSystem
perform basic sanitization on send, but it cares only about mail specification and ignores the fact that body might be HTML - that's on you. So you are guaranteed what you send will be formally valid e-mail, but not that it will be valid HTML. Exact part about body sanitization is:
// Note: e-mail uses CRLF for line-endings. PHP's API requires LF
// on Unix and CRLF on Windows. Drupal automatically guesses the
// line-ending format appropriate for your system. If you need to
// override this, adjust $conf['mail_line_endings'] in settings.php.
$mail_body = preg_replace('@\r?\n@', $line_endings, $message['body']);
And that's it, as mail is pretty accepting format and sets stricter requirements on other fields - NOT on body.
Using drupal_mail()
is safer than using backend directly, as it calls format method:
// Format the message body.
$message = $system->format($message);
And default's format method strips the HTML:
// Convert any HTML to plain-text.
$message['body'] = drupal_html_to_text($message['body']);
The big question is - how much do you trust drupal_html_to_text()
? It is there to made text valid, but it never claims it is a safeguard against malicious misuse. As far as I understand it's code, it should be reasonably safe in most cases, but as far as I remember there was some link related holes in mail readers that could be abused anyway.
TL;DR Basic sanitisation is done but there still might be some attacks possible.