Contact

A working email form. It checks itself on the server, sends with send email, and needs no JavaScript.

if email is not an email
  add "An email address we can reply to" to problems
end

if sent is "yes" and problems is empty
  send email to site_email
    subject: "[topic] from [name]"
    reply to: email
    from: site_from
    body: "[name] wrote:\n\n[message]"
  end
  go to "/contact?thanks=yes"
end

Why it is safe to put on a real site

• Only you choose who gets the email. send email to refuses a visitor's value, so nobody can use your form to mail anyone else. The visitor's address can only be the reply to:, and only when it is one real address.
• No header tricks. Line breaks in the subject become spaces, so a visitor cannot sneak in a Bcc:.
• Plain text only. The body is never HTML, so nothing a visitor types can run in your inbox.
• A speed limit. At most 3 emails each time a page runs, and 20 an hour for the whole site, so a robot cannot use the form to flood an inbox.
• One send per message. After sending, the page goes to ?thanks=yes, so refreshing does not send again.

Set the two addresses in settings.html: site_email is where messages go, and site_from is an address on your own domain that they come from.