Why not show people the current script you have? And yes, it's very possible to escape the header fields from being shown.