email form security

[studentofstone]

I'm using the following to clean up input from my contact form,

but I got header injection attacked anyway. What am I doing wrong?

$trail_section_mile = strip_tags(stripslashes($trail_section_mile))
//this is repeated for several other fields, then:

$email_message .= "Trail Section Mile Markers: ".clean_string($trail_section_mile)."\n";
//this is repeated for several other fields, then:

/* see isInjected function below */
function clean_string($string) {
      $bad = array("content-type","bcc:","to:","cc:","href","/n","");
      return str_replace($bad,"",$string);
    }
// send the mail