Originally Posted by raymor

and note that you'll find yourself listed as a spammer at some point when the spambots find your form. For the "from" address they'll enter:

[email protected]
Cc: [email protected], [email protected], [email protected]...

For the from address or anything else user submitted, use only the captured text from a proper regex match on valid input.