For a even a novice hacker POST and GET are equally in secure. The advantage in POST is that the average user doesn't try something dumb. Like bookmarking the page that has the GET values in the URL. Which in your case will cause the email to be sent, again.
So use Post for the form
<form id="yourid" name="yourname" method="post" action="yourpage.php">
Next you have to validate. For a basic site I do this 2 different ways.
First I validate that the script was submitted from a the exact page have it on. A common attack is to submit from the hackers server. For example if you have a form on http://www.mysite.com/form.php and hacker has this form
<form id="yourid" name="yourname" method="post" action="http://www.mysite.com/form.php">
on his http://www.hackingsite.com/malicious_form.php, what is to stop your site form process the form he submits? Nothing! Unless you do a
if($_SERVER['HTTP_REFERER'] != 'http://www.mysite.com/form.php') {
die;
}
else {
// do something with form data
}
Second, the user can manually submit code into your form. You can use built in PHP tools to stop them. [man]htmlspecialchars[/man], [man]htmlentities[/man], [man]mysql_real_escape_string[/man], as well as many other methods, will disable the code that any malicious user may try to submit.
Both these methods work real well together to inhibit most malicious users. Do note I said "inhibit" and "most" as there will always be some who are able to find ways around your basic security. But they would need a very big incentive to be willing to try and hack your site or email.
