in reply to Vetting a CGI script

Security is really hard to impose after the fact. Ditch it, start over, use FormMail from the nms script archive.