security, is contact form safe?

hi,

I’m not a security expert (neither an html/javascript/php one), I’m just paranoid.
But I’m surprised that things like that do work in the “message” field of the contact form and are not filtered out :

<iframe width="560" height="315" src="http://www.youtube.com/embed/um1pIC3T37I" frameborder="0"></iframe>

<form>
First name: <input type="text" name="firstname">
</form>

is that common? can you confirm me that I’m just paranoid and that everything has been checked concerning the security of the contact form ?