You’re inserting raw POST data straight into an SQL query – sanitize, sanitize, sanitize! The code below should get you started, but I would advise you add some additional checks (is the email valid? are the strings too long? etc.):
<?php
$errors =
$values = array();
if ( isset( $_POST['Submit'] ) ) {
$fields = array(
'firstNametxt',
'lastNametxt',
'email',
'query',
);
foreach ( $fields as $field ) {
if ( isset( $_POST[ $field ] ) ) { // Never assume a POST field will be set
// Ensure the value is a string, POST data can be an array if the user is meddling
$value = ( string ) $_POST[ $field ];
// Strip slashes that WordPress adds
$value = wp_unslash( $value );
// Remove trailing/preceding whitespace
$value = trim( $value );
// Core WordPress function to check for invalid UTF-8, strip tags, remove line breaks etc.
$value = sanitize_text_field( $value );
} else {
$value="";
}
if ( ! $value )
$errors[ $field ] = 'This field is required.';
else
$values[ $field ] = $value;
}
if ( ! $errors ) {
$wpdb->insert(
$wpdb->prefix . 'contactus',
$values,
'%s'
);
}
}
?>
<?php if ( $errors ) : ?>
<p>Please ensure all fields are completed.</p>
<?php endif ?>
<form method="post">
FirstName <input type="text" name="firstNametxt" value="" /><br/>
LastName <input type="text" name="lastNametxt" value="" /><br/>
email <input type="text" name="email" value="" /><br/>
Query <input type="text" name="query" value="" /><br/>
<input name="Submit" type="submit" value="Submit">
</form>
And read up on the codex for safely inserting into tables using wpdb::insert()