Problem with php processing page

Question

I am new to php and have created a form for my website online.  When testing upon submit the form goes to my email fine with all the fields coming in correct.  The problem I am having is the processing form is also sending a blank email along with the correct one and also i get at least one blank email a day.  I am not sure where I need to add something into my code or if it is just the users hitting submit without anything filled out. Also any tips and advice on how to prevent email injection would be much helpful. I have read up on this and not really sure where to add protection code. Thanks for the replies they will be much appreciated. 
Here is the code from the php process page:
<?php
/* Subject and Email Variables */
$emailSubject = 'Online Order';
$webMaster = '[email protected]';
/* Gathering Data Variables */
     $competition = $_POST['competition'];
     $product = $_POST['product'];
     $eventcitytwoField = $_POST['eventcitytwo'];
     $eventstateField = $_POST['eventstate'];
     $eventdateField = $_POST['eventdate'];
     $eventdatetwoField = $_POST['eventdatetwo'];
     $routineoneField = $_POST['routineone'];
     $routinetwoField = $_POST['routinetwo'];
     $routinethreeField = $_POST['routinethree'];
     $routinefourField = $_POST['routinefour'];
     $routinefiveField = $_POST['routinefive'];
     $routinesixField = $_POST['routinesix'];
     $firstnameField = $_POST['firstname'];
     $lastnameField = $_POST['lastname'];
     $phoneField = $_POST['phone'];
     $email = $_POST['email'];
     $shippingField = $_POST['shipping'];
     $shippingstateField = $_POST['shippingstate'];
     $zipcodeField = $_POST['zipcode'];
     $cctypeField = $_POST['cctype'];
     $ccnumberField = $_POST['ccnumber'];
     $expdateField = $_POST['expdate'];
     $expyearField = $_POST['expyear'];
     $billingaddressField = $_POST['billingaddress'];
     $billingcityField = $_POST['billingcity'];
     $billingstateField = $_POST['billingstate'];
     $billingzipField = $_POST['billingzip'];
     $commentsField = $_POST['comments'];
$body = <<<EOD
<br><hr><br>
Competition: $competition <br>
Product: $product <br>
Event City: $eventcitytwo <br>
Event State: $eventstate <br>
Event Month: $eventdate <br>
Event Day: $eventdatetwo <br>
Routine One: $routineone <br>
Routine Two: $routinetwo <br>
Routine Three: $routinethree <br>
Routine Four: $routinefour <br>
Routine Five: $routinefive <br>
Routine Six: $routinesix<br>
First Name: $firstname <br>
Last Name: $lastname <br>
Email: $email <br>
Phone Number: $phone <br>
Shipping Address: $shipping <br>
Shipping State: $shippingstate <br>
Shipping Zip: $zipcode <br>
Credit Card Type: $cctype <br>
Credit Card Number: $ccnumber <br>
Exp Month: $expdate<br>
Exp Year: $expyear <br>
Billing Address: $billingaddress <br>
Billing City: $billingcity <br>
Billing State: $billingstate <br>
Billing Zipcode: $billingzip <br>
Comments: $comments <br>
EOD;
     $headers = "From: $email\r\n";
     $headers .= "Content-type: text/html\r\n";
     $success = mail($webMaster, $emailSubject, $body, $headers);

Answer 1

You are not posting the data to a database, so you have fewer security concerns, but you SHOULD post to a database because as it is now, you probably have to re-enter all that data that comes in through the email. You can have the data sent to a database and then emailed in the same script.
For form security, validate some fields using REGEX. The email address is an obvious one. You can also require that some fields be filled in, which will eliminate your blank submissions. Use CSS to hide a "dummy" field. Visitiors won't see it but spambots will see it and fill it out. Create a routine upon submission that rejects any submission that doesn't have that field blank. If you do change your form to post to a database, don't post to $_SERVER['PHP_SELF'] as that is not secure.
You asked a big question and I just gave you some pointers above. Use the security forum at the following website for help with security issues:
http://forums.devnetwork.net/index.php