Safety of contact form I have made slight edits to a simple PHP contact form that I have found online. Can you see anything else that I could do to ensure that I am protected from email injections and spam? I have used trim, stripslashes and htmlspecialchars and made a simple question to act as spam prevention.

&lt;?php

$myemail = "YOUR EMAIL ADDRESS";

$name = check_input($_POST['name'], "Enter your name");
$email = check_input($_POST['email']);
$message = check_input($_POST['message'], "Write your message");
$captcha = check_input($_POST['captcha']);

if (!preg_match("/([\w\-]+\@[\w\-]+\.[\w\-]+)/", $email))
{
show_error("E-mail address not valid");
}

if (!preg_match("/5/", $captcha))
{
show_error("Check your math");
}


$message = "

Name: $name
E-mail: $email

Message:
$message

";

mail($myemail, $subject, $message);

header('Location: thanks.html');
exit();

function check_input($data, $problem='')
{
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);

if ($problem &amp;&amp; strlen($data) == 0)
{
show_error($problem);
}
return $data;
}

function show_error($myError)
{
?&gt;
&lt;html&gt;
&lt;body&gt;
&lt;p&gt;Please correct the following error:&lt;/p&gt;
&lt;strong&gt;&lt;?php echo $myError; ?&gt;&lt;/strong&gt;
&lt;p&gt;Hit the back button and try again&lt;/p&gt;

&lt;/body&gt;
&lt;/html&gt;
&lt;?php
exit();
}
?&gt;
Most of my comments are unrelated to security.  A few down at the bottom.  

$myemail = "YOUR EMAIL ADDRESS";


Elsewhere you use snake_case names.  If you did that here, you'd have $my_email.  I'm assuming that you removed the read email address for privacy reasons.  

if (!preg_match("/([\w\-]+\@[\w\-]+\.[\w\-]+)/", $email))
{
show_error("E-mail address not valid");
}


The indenting here is not standard.  Usually it would have been written 

if ( ! preg_match('{([\w\-]+\@[\w\-]+\.[\w\-]+)}', $email) )
{
    show_error("E-mail address not valid");
}


I also added some whitespace in the if because I find it easier to read.  

I changed to a single quoted string and used a different regular expression delimiting pair.  

Another problem is that this will match some invalid emails.  For example, -@-.- is valid in this pattern.  So if those five characters appear in the field, it will be recognized as valid.  Note that you don't restrict characters that appear before and after that sequence.  

if (!preg_match("/5/", $captcha))


This would match 15, 51, etc. as well as 5.  You don't need to use preg_match here.  You can just say something like 

if ( '5' != $captcha )


or

if ( 5 != (int)$captcha )


Note that if you want the exact original functionality (match any string that contains the number 5), you could say 

if ( false === strpos($captcha, '5') )


That would be much faster than the regular expression version.  

$message = "

Name: $name
E-mail: $email

Message:
$message

";


This would more commonly be written with a heredoc rather than a multiline double quoted string.  

$message = &lt;&lt;&lt;EOM

Name: $name
E-mail: $email

Message:
$message

EOM;


You don't need a final 

?&gt;


The usual convention is to leave it off if your script is not supposed to produce output.  Technically speaking show_error does produce output, but it's not supposed to be called by the script.  I'd leave off the final ?&gt;.  

Security

You don't show how the $subject is set, so it's unclear if it's safe or not.  If this is the whole script, it will send with a blank subject.  

Note that trim and stripslashes do not add security.  They help fix the input to make it display properly.  The normal use of stripslashes is to undo a PHP security protection that didn't quite work right.  The htmlspecialchars is the security function.  I'm not sure that email is vulnerable to HTML characters.  Perhaps your email client is though.