I notice that you're not doing any client-side javascript validation. While it is a Very Bad idea (TM) to rely solely on client-side validation, it makes perfect sense to do whatever checks possible on any input data on the client-side. You can always repeat the same tests on the server side as well. Why is this a good idea? It pushes some work out to the client and takes load off your server. If you can catch errors before they come near your server, so much the better for you.
As regards vetting email addresses, you can use regular expressions to determine what looks like a potentially valid address, as discussed above. It's vital that any test you use is based on the actual standards rather than what people think looks good. I know many sites that reject email addresses with apostrophes in them, allthough they are perfectly valid, and indeed common - think of irish surnames like O'Callaghan etc. John.O'Callaghan@someorg.somewhere.com is syntactically a valid email address.
None of this regular expression matching will determine whether or not a given email actually exists. If you want to you could write a few lines of PHP which will attempt to determine the mail server for the email address given, connect to it and start sending a mail to the address given. If the mail server rejects it then you know that the address is currently invalid. I don't know of too many cases where this is worth doing, but it's certainly an option.
When validating phone numbers, make sure you determine who your audience is. The regular expressions given above are fine for domestic US numbers, but will frustrate the heck out of your international visitors.
Checking for unset variables is not as straightforward as you might think. Checking for ! or isset are open to ambiguities. For instance, if I recall correctly, a (potentially valid) value of $var = 0 (zero ) in a field could cause !$var to be evaluated as true. An article in a past issue of PHP Architect suggested checking the length of the variable value, and only assume it's blank if the length is zero.
Of special importance when you are writing a form which sends an email is to protect it from hijacking by spammers. Otherwise your script will be absuied to send tons of dodgy emails. You should check that the form has only vbeen called from your domain at least. You might also want to consider using your inputform to set a session variable which is hash of the current date, the remote IP and a secret and check for this variable when processing the form input. A failure on this would be a strong indicator that the form is being submitted in a manner other than you would want, and you should probably not send the mail.
Finally, and again cruially for an email form, you need to check all inputs to make sure that things like closing quotes, commas and semicolons dont cause you to do something you didn't intend to.
Just some food for thought
