I think you need to add the From as an address on your server and put a Reply-to header so that when you get the email in your inbox you can reply to it in the normal way.
As far as I can see instead of a From on your server you have their full name from the form.
To quote @nana-partykar for the message part - replace from $message
onwards with:
$message="Name: ".$fullname."<br/>Age: ".$age,"<br/>Gender",$gender."<br/>Phone".$phone."<br/>Dept:".$department;
$your_email = 'your_email@your_server.com';
$headers = "From: $your_email" . "\r\n";
// Additional headers
$headers .= "Reply-To: $email" . "\r\n";
if(mail($to,$subject,$message,$headers)){
echo "Success";
} else {
echo "not sent";
}
http://php.net/manual/en/function.mail.php
You could also try setting the sendmail user at the top of your script:
ini_set('sendmail_from', 'your_email@your_server.com');
http://php.net/manual/en/book.mail.php
As far as validation is concerned you could clean up what is submitted to allow only letters, numbers and a few other characters:
$email = preg_replace("[^a-zA-Z0-9@._-]",'',$_POST['email']);
and at least make sure that the essential email address is not empty by wrapping the mail part with:
if($email != ""){
if(mail....to the end
}
If you are putting any of the received information into a database you need to ensure it is also free of inject attack code
How can I prevent SQL injection in PHP?
I would suggest getting it working first before you do that...but do do it!