... spoofing? Emails cannot be 'sent' in vbscript, they can be sent with ASP which can be coded in vbscript. That person who told you about spoofing does not sound like a reliable source. There is a chance they were referring to an html form with client side vbscript, but your concern should not be 'spoofing' whatever that is, but rather the fact that only one browser supports it. ASP will be as secure as PHP, it just depends on what measures the person writing it takes to prevent spam, such as not allowing a user to submit more then 2 times in a minute, etc.