Hi 
I'm developing a contact form. I'm using the mail function to email it over to the webmaster.

Is there a risk someone could inject malicious javascript and any other injection attack?

```
$to = (this is from config xml file)
$message = $_POST['message'];
mail($to ,'feedback',$message);

```