Is this PHP Email Form Secure from injections or other abuses? I am new to PHP and put this contact page together using the w3Schools.com example as a guide along with a couple other sources. As far as I can tell, it works fine, but before I put it up on my page I would like to know if there is any potential for abuse. Any feedback is appreciated.

&lt;!DOCTYPE html&gt;
&lt;html&gt;
&lt;head&gt;
&lt;?php include 'header.php'; ?&gt;
&lt;/head&gt;
&lt;body&gt;

&lt;?php
require_once "Mail.php";
function spamCheck($field) {
    $field = filter_var($field, FILTER_SANITIZE_EMAIL); 
    if (filter_var($field, FILTER_VALIDATE_EMAIL)) {
        return true;
    } else {
        return false;
    }
}

if (isset($_REQUEST['email'])) {
    $mailcheck = spamCheck($_REQUEST['email']);
    if ($mailcheck == false) {
        echo "Invalid Input";
    } else {
        $from = $_REQUEST['email'];
        $body = "From\n" . $from . "\n\n"  .  $_REQUEST['message'];
        $to = "&lt;REMOVED&gt;";
        $subject = "$_REQUEST['subject'];
        $host = "&lt;REMOVED&gt;";
        $port = "&lt;REMOVED&gt;";
        $username = "&lt;REMOVED&gt;";  
        $password = "&lt;REMOVED&gt;";
        $headers = array('From' =&gt; $from, 'To' =&gt; $to, 'Subject' =&gt; $subject);
        $smtp = Mail::factory('smtp',array ('host' =&gt; $host,
             'port' =&gt; $port,
             'auth' =&gt; true,
             'username' =&gt; $username,
             'password' =&gt; $password));
        $mail = $smtp-&gt;send($to, $headers, $body);
        if (PEAR::isError($mail)) {
            echo("&lt;p&gt;" . $mail-&gt;getMessage() . "&lt;/p&gt;");
        } else {
            echo("&lt;p&gt;Message successfully sent!&lt;/p&gt;");
        }
}



} else {
    echo "&lt;h1&gt;Send me an email if you like.&lt;/h1&gt;
    &lt;br&gt;&lt;form method='post' action='contact.php'&gt;&lt;br&gt;
    &lt;p&gt;Your Email: &lt;input name='email' type='text'&gt;
    Subject: &lt;input name='subject' type='text'&gt;&lt;/p&gt;
    &lt;p&gt;Message:&lt;br&gt;
    &lt;textarea name='message' rows='15' cols='40'&gt;
    &lt;/textarea&gt;&lt;br&gt;
    &lt;input type='submit'&gt;&lt;/p&gt;
    &lt;/form&gt;";
}   
?&gt;
&lt;/body&gt;
&lt;?php include "footer.php"?&gt;
&lt;/html&gt;
I use a blank input field in the form and hide it with css.  If the field exists upon form submit, I know it's spam and just ignore it.

&lt;form method="post"&gt;
&lt;input type="text" name="email" /&gt;
&lt;input type="text" name="email2" style="display:none;" /&gt;
&lt;input type="submit" /&gt;
&lt;/form&gt;

&lt;?php if (!$_POST['email2']) { // not spam } ?&gt;


Of course this only works with bots and spammers who scrape sites to get all the input fields, but since I've implemented it, it's worked great.