mail

I found this in a server:

$header = "From: <".$_REQUEST['email'].">\n";
#... 
mail($from,$subjet,$message,$header);

$_REQUEST['email'] came from a form input ...

Here $_REQUEST['email'] should be, at least, stripped by all \n no matter on how you trust to js code..

$from = $_REQUEST['email'];
$from = str_replace("\n","",$from);
$header = "From: <$from>\n";