HTML, Email, Oracle Service Cloud, All supported versions
PHP can only be executed on a server. Once executed on a server, it produces HTML output that can be viewed on a client side. End user never faces PHP code on a client side as PHP is a server side scripting language. If for some reason PHP code will be added into the body of the email as a part of an HTML/CSS formatting it will be processed as plain text and will not be executed.
On the other hand, file attachments may contain executable files and pose a threat. For more information about how to open file attachments without executing code, refer to Answer ID 2202: Opening file attachments without executing the code in the file.