1 If you are going to use any user input in any part of the headers, be careful. ie, don't do it. Don't use the input for "To", "From" or "Subject".
2. Just the body of the message? You want them to send you HTML? Why? If not, strip out all HTML markup and then remove any occurrences of...