In securing simple email contact form
<p>I have very basic PHP skills. As it stands, I'm trying to "reverse" engineer a contact form I found line that has some level security (I truthfully don't know how good it is). I think I got it, it works, but I just thought maybe some of you more experience in php can glance it over and see if it's actually still secure.</p>

<p>As I said, I reverse engineered it, so I don't know if I broke the security, but it does work just fine. As you can see it's pretty basic. I've been reading a lot and learning about what everything does, just worried about ordering and redundancy (want to avoid it if necessary)... basically anything I can do to clean it up as much as I can.</p>

<p>Code below:</p>

<pre><code>&lt;?php
            $to='my@mail.com';
            $sender=stripslashes($_POST['sender']);
            $email=stripslashes($_POST['email']);
            $subject=stripslashes($_POST['subject']);
            $message=stripslashes($_POST['message']);
            $body=  "Greetings,\n\n$message\n\n$sender" .
                    "\n" ;

            $displayForm=true;
            if ($_POST){
                $sender=($_POST['sender']);
                $email=($_POST['email']);
                $subject=($_POST['subject']);
                $message=($_POST['message']);
                $valid=eregi('^([0-9a-z]+[-._+&amp;])*[0-9a-z]+@([-0-9a-z]+[.])+[a-z]{2,6}$',$email);
                $crack=eregi("(\r|\n)(to:|from:|cc:|bcc:)",$sender);
                $crack=eregi("(\r|\n)(to:|from:|cc:|bcc:)",$message);
                    if ($sender &amp;&amp; $email &amp;&amp; $message &amp;&amp; $valid &amp;&amp; !$crack){
                    if (mail($to,$subject,$body,'From: '.$email."\r\n")){
                $displayForm=false;
        ?&gt;
        &lt;div&gt;Your message has been sent successfully. Thank you for contacting us.&lt;/div&gt;
        &lt;?php
            echo '&lt;p&gt;'.htmlspecialchars($message).'&lt;/p&gt;';
            }else {
        ?&gt;
        &lt;div&gt;Your message could not be sent due to a system error. We apologize for any inconvenience.&lt;/div&gt;
        &lt;?php
            }
            }else if ($crack){
        ?&gt;
        &lt;div&gt;Your message contained one or more anomalies, indicative of malicious content. Please consider revising your wicked ways.&lt;/div&gt;
        &lt;?php
            }else {
        ?&gt;
        &lt;div&gt;You failed to complete a required field, or to provide a valid email address.&lt;/div&gt;
        &lt;?php
            }
                }
            if ($displayForm){
?&gt;

&lt;form action="./" method="post"&gt;
    &lt;div class="contact-border"&gt;&lt;input class="contact-textbox" type="text" name="sender" id="sender" tabindex="1" value="&lt;?php echo htmlspecialchars($sender); ?&gt;" /&gt; &lt;strong&gt; Name&lt;/strong&gt;&lt;/div&gt;

    &lt;div class="contact-border"&gt;&lt;input class="contact-textbox" type="text" name="email" id="email" tabindex="2" value="&lt;?php echo htmlspecialchars($email); ?&gt;" /&gt; &lt;strong&gt; Email Address&lt;/strong&gt;&lt;/div&gt;

    &lt;div class="contact-border-noreq"&gt;&lt;input class="contact-textbox-noreq" type="text" name="subject" id="subject" tabindex="3" value="&lt;?php echo htmlspecialchars($subject); ?&gt;" /&gt; &lt;strong&gt; Subject (optional)&lt;/strong&gt;&lt;/div&gt;

    &lt;div class="contact-border"&gt;&lt;textarea class="contact-textbox" name="message" id="message" cols="90" rows="15" tabindex="4" &gt;&lt;?php echo htmlspecialchars($message); ?&gt;&lt;/textarea&gt;&lt;/div&gt;

    &lt;div&gt;&lt;input class="submit-button" type="submit" value="Submit" name="submit" /&gt;&lt;/div&gt;
&lt;/form&gt;
        &lt;?php
            }
        ?&gt;
</code></pre>
