PHP e-mail form with ReCAPTCHA
Since $_POST['vname'] is not escaped, your mail script is vulnerable to a header-splitting attack like this.  A cleverly crafted name could be used to make your script CC any arbitrary recipient and thus send spam.