<?
$notify_injections = true; 
$mail_target = 'ваш@емайл.ru'; 
$author = @$_POST['sender_name'];
$mail = array('sender' => @$_POST['sender'],	
	'subject' => @$_POST['subject']);
$mail_message = @$_POST['message'];
function validate_mail($field, $mail_header) {
	$alert = '';
	if (@preg_match_all("/(\r|\n)([^:]+):/", $mail_header, $m)) foreach($m[0] as $v) $alert .= '<span style="width:100px;font:bold">'.$field.'</span>'.$v.'<br>';	
	return $alert;
}
$show_form = true;	
if ($mail_message != '') {	
	$alert = '';
	foreach ($mail as $k => $v) $alert .= validate_mail($k, $v);	
	if ($alert != '') {
		if ($notify_injections == true) $mail_result = @mail($mail_target, 'E-mail insertion attack', '<html><body>E-mail injection attempted via header insertion<p><span style="width:100px;font:bold">Remote IP</span>'.@$_SERVER['REMOTE_ADDR'].'<br><span style="width:100px;font:bold">Remote Host</span>'.@$_SERVER['REMOTE_HOST'].'<p><span style="width:100px;text-decoration:underline">form-field</span><u>injected header</u><br>'.$alert.'</body></html>');
		if ($mail_result == 1) {					
			echo "<script> alert('Ваше письмо было отправлено!'); document.location.href='/';</script>";	
			$show_form = false;					
		}
		else echo "<script> alert('письмо не отправлено. Попробуйте позже.!'); document.location.href='/';</script>";
	}
	else if (!preg_match("/^[A-Z0-9._%-]+@[A-Z0-9][A-Z0-9.-]{0,61}[A-Z0-9]\.[A-Z]{2,6}$/i", $mail['sender'])) echo '<span class="alert">* A valid e-mail address is required for your comments to be registered *</span>';
	else if ($mail['sender'] == '' or $author == '') echo '<span class="alert">Введите правильные данные!</span>';
	else {
/*** Отправляем E-Mail ***/
$message = "$mail_message\n-----------------------------------\n$author $mail[sender]\n";
$headers = "Content-type: text/plain; charset=windows-1251\r\n";
$headers .= "From: ".$author." <".$mail[sender].">\r\n";
$headers .= "Reply-To: ".$author." <".$mail[sender].">\r\n";
$mail_result = @mail($mail_target, $mail['subject'], $message, $headers);
/*************************/
		if ($mail_result == 1) {	
			echo "<script> alert('Ваше письмо было отправлено!'); document.location.href='/';</script>";
			$show_form = false;
		}
		else echo 'Ошибка: письмо не отправлено. Попробуйте позже.';
	}
}
if ($show_form == true) echo '<p><form action="contact.html" method="post">
<table style="border:0;text-align:left;line-height:24px;width:400px;padding:4px"><tr><td style="padding:0 15px 0 0">Имя:<br>
<input name="sender_name" type="text" maxlength="50" value="'.@$mail['sender_name'].'"></td>
<td>E-mail адрес:<br>
<input name="sender" type="text" maxlength="50" value="'.@$mail['sender'].'"></td></tr>
<tr><td colspan=2><p>Тема:<br>
<input name="subject" type="text" maxlength="100" value="'.@$mail['subject'].'" style="width:400px;font:8pt Verdana;padding:4px">
<p>Содержание:<br>
<textarea name="message" rows="10" style="width:400px;font:8pt Verdana;padding:4px">'.@$mail_message.'</textarea>
<p><input type="submit" name="submit" value="Отправить">
</td></tr></table>
</form>';
?>