title: Do I need to escape/sanitize the following? If so, what is the best method?
body: <p>Do I need to escape/sanitize the following?</p>
  
  <ol>
  <li><p><code>$_SERVER['HTTP_USER_AGENT']</code> in a
  PHP script (not inserted into
  database or displayed to user), for
  example:</p>
  
  <pre><code>if ($_SERVER['HTTP_USER_AGENT']==$xyz) {
          echo "Congrats, you are using XYZ browser";
  } else {
          echo "You are not using XYZ browser.";
  }
  </code></pre></li>
  <li><p><code>$_SERVER['HTTP_USER_AGENT']</code> when
  placed as a session variable, for
  example:</p>
  
  <pre><code>$_SESSION['userAgent']=$_SERVER['HTTP_USER_AGENT']
  </code></pre></li>
  <li><p>Anything that is going to be hashed,
  for example:</p>
  
  <pre><code>hash('sha512',$randomDataPostedByUser)
  </code></pre></li>
  <li><p>User input destined for email body
  (in other words, I've already taken
  care of email header injections).</p></li>
  </ol>
  
  <p>If any of the above do need to be excaped/sanitized, what is the best method for each case?</p>