PHP contact us form security
<p>I have the following script in PHP</p>

<pre><code>    &lt;?php

$userips = ($_SERVER['X_FORWARDED_FOR']) ? $_SERVER['X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];

$ips = $userips;

$rs = strip_tags($reason);
$ms = strip_tags($message);
$em = strip_tags($email);

$nm = strip_tags($name);
$mf = strip_tags($mail_from);


// Contact subject
$subject ="$rs";

// Details
$message="$ms" . "\n\n\n==-   Sent from the website with IP Address: " . $ips . "   -==";


// Mail of sender
$mail_from="$em";

// From
$header="from: $nm &lt;$mf&gt;";


// Enter your email address
$to ='hta@example.com';

$send_contact=mail($to,$subject,$message,$header);

header("Location: http://www.example.com");


// Check, if message sent to your email
// display message "We've recived your information"
// if($send_contact){
// echo "We've recived your contact information";
// }
// else {
// echo "ERROR";
// }
?&gt;
</code></pre>

<p>Now question is, will it allow user to perform a XSS attack on my site by entering script in the form field to modify the site or does it look attack proof. If not any suggestion can be made to improve?</p>
