filter_var(...) explicitly does not strictly adhere to the RFCs. And yes, that is, technically, a valid email address: "\"Attacker\\' -Param2 -Param3\"@te

filter_var(...) explicitly does not strictly adhere to the RFCs. And yes, that is, technically, a valid email address: "\"Attacker\\' -Param2 -Param3\"@test.com" gets interpreted by the shell (or by PHP, or by whatever else is responsible for handling backslash-escaped entities in quoted strings) as "Attacker\' -Param2 -Param3"@test.com and "Attacker\' -Param2 -Param3" is a valid local-part: https://tools.ietf.org/html/rfc5321#section-4.1.2 https://tools.ietf.org/html/rfc5321#section-4.1.2 (Email addresses suck and this is not me saying that this is sane.)