如何在联系表单中阻止电子邮件标题注入？

Question

I am a newbie on PHP but manage to create a working contact form. But then I got aware of Email Header Injection. How can I prevent this in best possible way? Don't want my form to be used to spam people.

This is my code:

<?php 
if ($_POST["email"]<>'') { 
    $ToEmail = '[e-mail]'; 
    $EmailSubject = 'Email Subject'; 
    $mailheader = 'From: [e-mail]' . "
" .
        'Reply-To:' .$_POST["email"]. "
" .
        'MIME-Version: 1.0'."
".
        'Content-Type: text/html; charset=utf-8'."
".
        'X-Mailer: PHP/' . phpversion();
    $MESSAGE_BODY .= "<b>Navn:</b> ".$_POST["name"]."<br />"; 
    $MESSAGE_BODY .= "<b>Telefon:</b> ".$_POST["telephone"]."<br />";
    $MESSAGE_BODY .= "<b>Email:</b> ".$_POST["email"]."<br /><br />"; 
    $MESSAGE_BODY .= "".nl2br($_POST["message"])."<br />"; 
    mail($ToEmail, $EmailSubject, $MESSAGE_BODY, $mailheader) or die ("Failure"); 

?>

Answer 1

Just Put the validation for email field as shown below:

$email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);

if ($email === FALSE) {
    echo 'Invalid email';
    exit(1);
}

It validates your Email format which will not allow any kind of injected headers.