[cd34]

Another very good suggestion. Remember though that DNS lookups in PHP are serialized and not multi-threaded. Get hit with a bunch of form submits at the wrong time and you've got a small Denial of Service problem on your machine.

Also, if you are putting other headers in that 4th argument, you will want to validate them to ensure good values as well.

Simple checks to check for \r, \n might give you a head start. I prefer to validate a field to make sure it contains what I want, rather than to try and figure out what I don't want.