PHP e-mail form with ReCAPTCHA I want to ask if you can review the code for a simple contact form and the PHP code which sends me an email once a visitor fills the form and is validated through Recaptcha

On my index.php file here are the form and php code

HTML:

&lt;form id="contactform" action="index.php#contact" method="post" class="form" role="form"&gt;

    &lt;div class="form-group"&gt;
      &lt;input class="form-control required" id="vname" name="vname" placeholder="Your Name" type="text" required /&gt;
    &lt;/div&gt;

    &lt;div class="form-group"&gt;
      &lt;input class="form-control required" id="vemail" name="vemail" placeholder="Your Email" type="email" required /&gt;
    &lt;/div&gt;

    &lt;div class="form-group"&gt;
      &lt;textarea class="form-control required" id="msg" name="msg" placeholder="Your Message" rows="7" required&gt;&lt;/textarea&gt;
    &lt;/div&gt;

    &lt;div class="form-group"&gt;
      &lt;div class="g-recaptcha" data-sitekey="GOOGLE PUBLIC KEY"&gt;&lt;/div&gt;
    &lt;/div&gt;

    &lt;div class="form-group"&gt;
      &lt;input type="submit" class="btn btn-success form-send" value="Send"&gt;
    &lt;/div&gt;  

&lt;/form&gt;


PHP:

&lt;?php
  $captcha;
    if (isset($_POST['g-recaptcha-response'])) { $captcha = $_POST['g-recaptcha-response']; }
  // Check for correct reCAPTCHA
    $response = file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=GOOGLE SECRET KEY&amp;response=" . $captcha . "&amp;remoteip=" . $_SERVER['REMOTE_ADDR']);
    if (!$captcha || $response.success == false) {
        echo "Your CAPTCHA response was wrong";
        exit ;
      } else {
        // Check for Blank Fields..
        if ($_POST["vname"] == "" || $_POST["vemail"] == "" || $_POST["msg"] == "") {
    echo "Please fill all required fields";
} else {
    // Check if the "Sender's Email" input field is filled out
    $email = $_POST['vemail'];
    // Sanitize E-mail Address
    $email = filter_var($email, FILTER_SANITIZE_EMAIL);
    // Validate E-mail Address
    $email = filter_var($email, FILTER_VALIDATE_EMAIL);
    if (!$email) {
        echo "Invalid Sender's Email";
    } else {
        $to = 'myemail@mail.com';
        $subject = 'New Form Entry';
        $message = "New message was submitted from &lt;br /&gt; " . "&lt;strong&gt;" . $_POST['vname'] . "&lt;/strong&gt;" . "&lt;br /&gt;&lt;br /&gt;The message is:&lt;br /&gt;" . "&lt;strong&gt;" . $_POST['msg'] . "&lt;/strong&gt;";
        $headers = "From:" . $_POST['vname'] . "&lt;" . $email . "&gt;";
        $headers .= "MIME-Version: 1.0" . "\r\n";
        $headers .= "Content-type:text/html;charset=UTF-8" . "\r\n";
        // Sender's Email
        // Message lines should not exceed 70 characters (PHP rule), so wrap it
        $message = wordwrap($message, 70, "\r\n");
        // Send Mail By PHP Mail Function
        if (mail($to, $subject, $message, $headers)) {
            echo "Your mail has been sent successfully!";
        } else {
            echo "Failed to send email, try again.";
            exit ;
        }
    }
}
}
?&gt;


The only function of this is to send me an email and it works as I want it, but I am not aware if this form is secure? 

Is it possible that someone can exploit this code and upload a shell, or do any other sort of attack against my site.
Since $_POST['vname'] is not escaped, your mail script is vulnerable to a header-splitting attack like this.  A cleverly crafted name could be used to make your script CC any arbitrary recipient and thus send spam.