Is this contact form safe? Here is the code that I am using on a website's contact form:

HTML file:

    &lt;form name="ajax-form" id="ajax-form" action="php-file.php" method="post"&gt;
        &lt;label for="name"&gt;Name: * 
            &lt;span class="error" id="err-name"&gt;please enter name&lt;/span&gt;
        &lt;/label&gt;
        &lt;input name="name" id="name" type="text" /&gt;
        &lt;label for="email"&gt;E-Mail: * 
            &lt;span class="error" id="err-email"&gt;please enter e-mail&lt;/span&gt;
            &lt;span class="error" id="err-emailvld"&gt;e-mail is not a valid format&lt;/span&gt;
        &lt;/label&gt;
        &lt;input name="email" id="email" type="text" /&gt;
        &lt;label for="message"&gt;Message:&lt;/label&gt;
        &lt;textarea name="message" id="message"&gt;&lt;/textarea&gt;
        &lt;button id="send"&gt;Submit&lt;/button&gt;
        &lt;div class="error" id="err-form"&gt;There was a problem validating the form please check!&lt;/div&gt;
        &lt;div class="error" id="err-timedout"&gt;The connection to the server timed out!&lt;/div&gt;
        &lt;div class="error" id="err-state"&gt;&lt;/div&gt;
    &lt;/form&gt;
    &lt;div id="ajaxsuccess"&gt;&lt;h2&gt;Successfully sent!!&lt;/h2&gt;&lt;/div&gt;


PHP file (php-file.php):

&lt;?php

$send_to = "contact@example.com";
$send_subject = "Ajax form ";

$f_name = cleanupentries($_POST["name"]);
$f_email = cleanupentries($_POST["email"]);
$f_message = cleanupentries($_POST["message"]);
$from_ip = $_SERVER['REMOTE_ADDR'];
$from_browser = $_SERVER['HTTP_USER_AGENT'];

function cleanupentries($entry) {
    $entry = trim($entry);
    $entry = stripslashes($entry);
    $entry = htmlspecialchars($entry);

    return $entry;
}

$message = "This email was submitted on " . date('m-d-Y') . 
"\n\nName: " . $f_name . 
"\n\nE-Mail: " . $f_email . 
"\n\nMessage: \n" . $f_message . 
"\n\n\nTechnical Details:\n" . $from_ip . "\n" . $from_browser;

$send_subject .= " - {$f_name}";

$headers = "From: " . $f_email . "\r\n" .
    "Reply-To: " . $f_email . "\r\n" .
    "X-Mailer: PHP/" . phpversion();

if (!$f_email) {
    echo "no email";
    exit;
}else if (!$f_name){
    echo "no name";
    exit;
}else{
    if (filter_var($f_email, FILTER_VALIDATE_EMAIL)) {
        mail($send_to, $send_subject, $message, $headers);
        echo "true";
    }else{
        echo "invalid email";
        exit;
    }
}

?&gt;


Is this code safe? How secure is the email address from users? Am I using best practices in this implementation?
Your code is safe as far as I can tell. You may consider adding some additional levels of spam checking though to stop invalid requests sooner. 


Use a token generated by your server when the form renders, pass that to php-file.php to check when processing the submission, if it isn't in your token list, it didn't come from your server. These tokens should only be used once before they are discarded. It will help you stop Cross Site Request Forgery attempts. It would mean having a storage medium to keep track of the tokens though, so it adds a little bit of overhead to the process. 
Honeypot field(s). These are just input fields that you hide with CSS so that a normal user would not fill them in. If they have a value when you process your script you should stop execution.