Not that it's relevant to your question (which anyhow something Yoda might say resembles . . . ), but using an unvalidated value provided by a user for either the from or to addresses is a Bad Idea®.