I have created a php contact form and have tried to make it relatively secure. I've added a honeypot field that should be left blank, code to ensure all required fields are filled out and code to prevent email injection. I realise there are endless ways to tighten up on security but I am trying to keep this script lightweight whilst covering most of the basic security issues.Are there any simple modifications that would improve the security of this script? Here is my current code:-Edit: added  as suggested.<?php  if (empty($_POST['honeypot'])){ $youremail = 'michael@example.com';$body = This is the result of your contact form:     First Name: $_POST[firstname]Last Name: $_POST[lastname]E-Mail: $_POST[email]Telephone: $_POST[telephone]Message: $_POST[message]; if( $_POST['email'] && !preg_match( /[\r\n]/, $_POST['email']) ) {$headers = From: $_POST[email];      } else { $headers = From: $youremail;  } if($_POST[message] ==  || $_POST[firstname] ==  ||     $_POST[lastname] ==  || $_POST[telephone] ==  || $_POST[message] ==     ){echo <p>Please fill in all fields</p>;} else {// finally, send the message     mail($youremail, 'Contact Form', $body, $headers ); } header('Location: http://www.example.com/thanks/');exit();?>
Contact form handler with a honeypot
php;security;email