Allowing the To: address to be passed from the form makes this an easy target for spammers to abuse and send mail to anyone they like.

Please   DO NOT   ever actually use this script.

It is also severly broken in several other ways. You should definitely read Ovid's excellent CGI course to understand how. For just getting your job done, you should use the formmail script from the NMS project's collection.

Makeshifts last the longest.