First things first, because your just starting out, you should get in the habit now of indenting your code properly. Reading your code might seem easy enough now, wait until your application has a few hundred thousand lines of code.
Secondly, you cannot output any data prior to calling the header() function. Make sure you have error reporting turned on and you should see warnings about his fact.
As for your questions;
Is it secure? Overal, there is nothing to be concerned about. The script doesn't actually do a greta deal. Why your encoding everything using html entities is beyond me though, your not sending a html email.
Second issue; You have the data the user has submitted in variables. Use them.
Third issue; At it's simplest you can simply store all your error messages within an array and then display them next to each missing form element.