Sorry I'm not too well educated in any programming, and new to PHP. I want to make sure my basic contact form is safe and can't be hijacked. I have a HTML form that submits data to the following PHP mail script. If I changed the 4th line to $field_email = filter_var($_POST['or_email'], FILTER_VALIDATE_EMAIL); then would this prevent injection. What other security changes should I make?
<?php
$field_name = $_POST['or_name'];
$field_company = $_POST['or_company'];
$field_email = $_POST['or_email'];
$field_tel = $_POST['or_tel'];
$field_package = $_POST['or_package'];
$field_details = $_POST['or_details'];
$mail_to = 'email@email.com'; //Change to your email
$subject = 'Enquiry from '.$field_name.' ('.$field_company.')'; //Change to your subject
$body_message = 'From: '.$field_name."
";
$body_message .= 'Company: '.$field_company."
";
$body_message .= 'E-mail: '.$field_email."
";
$body_message .= 'Phone: '.$field_tel."
";
$body_message .= 'Package: '.$field_package."
";
$body_message .= 'Details: '.$field_details;
$headers = 'From: '.$field_email."
";
$headers .= 'Reply-To: '.$field_email."
";
mail($mail_to, $subject, $body_message, $headers);
?>
Kind Regards,
Michael