> [784]
I prevent SQL Injections and spam in two respective ways. The host doesn't prevent spam, it's all backend.
> SQL Injection
First and for most, use the htmlspecialchars global function, you can use the function on your name/message variables, but I prefer to use it on the forms action attribute. It converts special characters into HTML entities. It also helps prevent any SQL Injections or any malicious HTML or Javascript code from being executed. Super handy!
> Spam prevention
To prevent spam from bots is a combination of the above and a hidden verification system. It's assumed that bots will fill out the entire form to prevent any errors (say, if not putting a name in returns an error.) So what I did was make a hidden verification system inside the form. If someone (in this case, a bot) fills out that system, it will quietly not send. You can actually see the verify input in the source code.
I hope this made sense? Please share your website. I'd love to check it out and comment on it! 