Is my script secure to prevent email injection? I have an email contact form that is PHP and very basic. I am concerned, however, that injections might be possible through it. So I was wondering if anyone with far superior PHP skills than myself would be willing to take a look and see if I have any gaps or vulnerabilities in my code that could be exploited. I very much appreciate any help with this.

PHP

&lt;?php

$field_name = isset( $_POST['cf_name'] ) ? preg_replace( "/[^\.\-\' a-zA-Z0-9]/", "", $_POST['cf_name'] ) : "";
$field_email = isset( $_POST['cf_email'] ) ? preg_replace(  "/[^\.\-\_\@a-zA-Z0-9]/" , "", $_POST['cf_email'] ) : "";
$field_message = isset( $_POST['cf_message'] ) ? preg_replace( "/(From:|To:|BCC:|CC:|Subject:|Content-Type:)/", "", $_POST['cf_message'] ) : "";

$mail_to = 'admin@mywebsite.com';
$subject = 'New Contact for My Website from '.$field_name;

$body_message = 'From: '.$field_name."\n";
$body_message .= 'E-mail: '.$field_email."\n";
$body_message .= 'Message: '.$field_message;

$headers = 'From: '.$field_email."\r\n";
$headers .= 'Reply-To: '.$field_email."\r\n";

$mail_status = mail($mail_to, $subject, $body_message, $headers);

?&gt;


For the brief moment I had this on Stack Overflow (before I was told that it should be here) the comment was made that I shouldn't be stripping characters out of emails. So... what should I do then? Is there a simple method to achieve the goal that I am missing? I am very new to this and just want to be as secure as possible.
Validate, but don't change user input

Don't change the value of a user input. Either accept or reject it, but don't try to guess what might be ment. Some examples:

The name could be Søren Kierkegård, which in many evironments will become Sren Kierkegrd due to your 'sanitation'.

An email address can be much more complicated than your test suggests. How about parenthesis, exclamation or question marks? Read this for other thoughts about email validation with regular expressions.

The message still could contain 'Bcc:' or 'Cc:'. Making the expression case insensitive will lead to the next problem: The sequence "People I met in Toronto: A, B, and C." would become "People I met in Toron A, B, and C." 

Escape your output instead

Header fields are restricted to a single line (each). So is the name of a person. In these cases, all whitespaces are equivalent (at least for non-malicious input), so replacing newlines and tabs with spaces does not alter the (meaning of the) content.

$name    = isset($_POST['cf_name']) ? $_POST['cf_name'] : '';
$email   = isset($_POST['cf_email']) ? $_POST['cf_email'] : '';
$message = isset($_POST['cf_message']) ? $_POST['cf_message'] : '';

$mail_status = sendMail($name, $email, $message);

function sendMail($name, $email, $message)
{
    // Whitespace pattern, icluding different masking methods
    $whitespace = '~(&lt;CR&gt;|&lt;LF&gt;|0x0A|%0A|0x0D|%0D|\\n|\\r|\s)+~i';

    $name = trim(preg_replace($whitespace, '', $name));
    if (empty($name)) {
        return false;
    }

    $email = trim(preg_replace($whitespace, ' ', $email));
    if (empty($email)) {
        return false;
    }

    $mail_to = 'admin@mywebsite.com';
    $subject = 'New Contact for My Website from ' . $name;

    $body =  "From: $name\n";
    $body .= "E-mail: $email\n";
    $body .= "Message: $message";

    $headers =  "From: $email\r\n";
    $headers .= "Reply-To: '$email\r\n";

    return mail($mail_to, $subject, $body, $headers);
}