Reviews on a contact-us form
The script is extremely basic but it seems to me that it is also not secure. I have seen similar code that vulnerable to header injection, so it was possible for spammers to add a BCC header, and instead spam other people through your server (and your IP address will get blacklisted as a result).
Even a seasoned class like phpmailer has suffered nasty security bugs. Another article that touches on the issue: Why mail() is dangerous in PHP
Since $mailHeaders is injectable, I can provide an E-mail address like:
someone@attacker.com@\r\nBcc: someone@victim.com
and I should be able to send spam to someone@victim.com, with your unwitting assistance.
Validation of form fields in Javascript is not sufficient, it has to be performed server-side as well. Javascript is useful for instant, client-side validation to avoid back and forth exchanges with the server but cannot be considered a security feature since you don't control the client and can't trust it.
It is only a matter of time until your form is indexed by spambots, that will start pounding your server. The bots don't care about Javascript. Your script will not stop them. So basically everything you wrote in JS has to be implemented server-side in PHP. JS validation is nice to have but optional.
Since it appears that you are using Bootstrap, you could perhaps take advantage of the validation options available. Then you can also get rid of the inline CSS styling eg: $(&quot;#userEmail&quot;).css('border', '#e66262 1px solid');.
You can also use the required attribute in your mandatory HTML controls. Then the browser will prompt the user if some fields are empty, and will not submit the form. It is a small extra and costs nothing.
To sum up, I suggest that you read up a bit on header injection and don't reinvent the wheel. There is mature, open-source third-party code available for this kind of task. It will be more secure that your homemade attempt.
I seem to remember that there is also the possibility of nullbyte injection but can't remember the details right now.