I have asked a question on Stack Overflow and one of the guys actually managed to hack my contact form and inject a fake email into the $header of the PHP! So after talking to him, he sent me a few articles, and I aimed to update the PHP to secure this gap and prevent the spam. Here is my old PHP:<?php   session_start();   if ($_SERVER['REQUEST_METHOD'] == 'POST'){      ob_start();      if(isset(         $_REQUEST['name'],         $_REQUEST['email'],         $_REQUEST['message'],         $_REQUEST['number'],         $_REQUEST['date'],         $_REQUEST['select'],         $_REQUEST['radio'],         $_REQUEST['checkbox'],         $_REQUEST['token']      )){         if($_SESSION['token'] != $_POST['token']){            $response = 0;         } else {            $_SESSION['token'] = ;            $name = $_REQUEST['name'];            $email = $_REQUEST['email'];            $message = $_REQUEST['message'];            $number = $_REQUEST['number'];            $date = $_REQUEST['date'];            $select = $_REQUEST['select'];            $radio = $_REQUEST['radio'];            $checkbox = $_REQUEST['checkbox'];            $to = ;            $subject = New Message From: $name;            $message = Name: $name<br/>                        number: $number<br/>                        date: $date<br/>                        select: $select<br/>                        radio: $radio<br/>                        checkbox: $checkbox<br/>                        Email: $email<br/>                        Message: $message;            $headers  = 'MIME-Version: 1.0' . \r\n;            $headers .= 'Content-type: text/html; charset=utf-8' . \r\n;            $headers .= 'From: '.$email . \r\n;            $mailed = (mail($to, $subject, $message, $headers));            if( isset($_REQUEST['ajax']))$response = ($mailed) ? 1 : 0;            else $response = ($mailed) ? <h2>Success!</h2> : <h2>Error! There was a problem with sending.</h2>;            echo $response;         }      } else {        echo Form data error!;      }      ob_flush();      die();   }?> and here is the updated version: <?php   session_start();   if ($_SERVER['REQUEST_METHOD'] == 'POST'){      ob_start();      if(isset(         $_REQUEST['name'],         $_REQUEST['email'],         $_REQUEST['message'],         $_REQUEST['number'],         $_REQUEST['date'],         $_REQUEST['select'],         $_REQUEST['radio'],         $_REQUEST['checkbox'],         $_REQUEST['token']      )){         if($_SESSION['token'] != $_POST['token']){            $response = 0;         }       else {            $_SESSION['token'] = ;            $name = $_REQUEST['name'];            $email = $_REQUEST['email'];            $message = $_REQUEST['message'];            $number = $_REQUEST['number'];            $date = $_REQUEST['date'];            $select = $_REQUEST['select'];            $radio = $_REQUEST['radio'];            $checkbox = $_REQUEST['checkbox'];         $email_pattern = /([\w\-]+\@[\w\-]+\.[\w\-]+)/;         $spam_pattern = /[\r\n]|Content-Type:|Bcc:|Cc:/i;         switch (true){            case !preg_match($email_pattern, $email):               $response = <b style='color: red'>Invalid email address!</b>;               break;            case !preg_match($spam_pattern, $name):            case !preg_match($spam_pattern, $number):            case !preg_match($spam_pattern, $date):            case !preg_match($spam_pattern, $select):            case !preg_match($spam_pattern, $radio):            case !preg_match($spam_pattern, $checkbox):            case !preg_match($spam_pattern, $message):               $response = <b style='color: red'>Invalid request made!</b>;               break;            default:               $to = ;               $subject = New Message From: $name;               $message = Name: $name<br/>                           number: $number<br/>                           date: $date<br/>                           select: $select<br/>                           radio: $radio<br/>                           checkbox: $checkbox<br/>                           Email: $email<br/>                           Message: $message;               $headers  = 'MIME-Version: 1.0' . \r\n;               $headers .= 'Content-type: text/html; charset=utf-8' . \r\n;               $headers .= 'From: '.$email . \r\n;               $mailed = (mail($to, $subject, $message, $headers));               $response = ($mailed) ?                  <h2 style='color: green'>Success!</h2>                     :                  <h2 style='color: blue'>Error! There was a problem with sending.</h2>;               break;            }         }      }      else {         $response = <b style='color: red'> Form data error! </b>;      }      ob_flush();   }?>Can you please share your opinion?  Does it look secure?
Preventing email injection
php;security;email