From a security standpoint

[memome]

The script below is loaded via iframe off my main page. For a security standpoint is there anything I should do to lock it down security wise?

 

<?php
// Constant Information(Make sure to edit only things between "" or else this may effect the program.)
$companyid = "id";             //Company ID
$password = "passwoprd";           // PASSWORD
$userid = "userid";         // User ID
$providerurl = "https://provider.com";          // provider url format of the url provider.

if (isset($_POST['submit'])){
$tosend = trim($_POST['tosend']);
$message = trim($_POST['message']);
$senderid = trim($_POST['sendid']);

header ("Location: {$providerurl}CompanyId={$companyid}&UserId={$userid}&Password={$password}&Msisdn={$tosend}&MessageText={$message}&OasText={$senderid}");
}
?>
<style type="text/css">
<!--
.style1 {color: #FFFFFF}
-->
</style>

<div align="center"></div>
<form name="form1" method="post" action="">
<table width="399" border="0">
      <tr>
        <th width="209" height="24" scope="col"><div align="left" class="style1"><span class="style1">Recipient: </span></div>
        <label></label></th>
        <th width="180" scope="col"><input name="tosend" type="text" id="tosend" value="1AREACODENUMBER" size="40"></th>
      </tr>
      <tr>
        <th height="24" scope="col"><div align="left" class="style1">Message:</div></th>
        <th scope="col"><label>
          <input name="message" type="text" id="message" size="40" />
        </label></th>
      </tr>
      <tr>
        <th height="24" scope="col"><div align="left" class="style1">Sender ID:</div></th>
        <th scope="col"><label>
          <input name="sendid" type="text" id="sendid" size="40">
        </label></th>
      </tr>
  </table>
  <label>
  <input type="submit" name="submit" id="submit" value="Send Message" />
  </label>
    <label>
    <input type="reset" name="clear" id="clear" value="Clear Form" />
    </label>
</form>

[zq29]

You need to cleanse your user input otherwise someone could execute code on your server. Either do some validation with some regex, or run your input through something like urlencode() or htmlentities()