When is it useful to use wp_verify_nonce

Yes, nonces should always be used when an authenticated user is triggering an action via a GET/POST request. One of the main purposes of the nonce is it ensure that the current user actually intended to trigger this request. It prevents the security vulnerability known as Cross-Site Request Forgery (CSRF), where an attacker can trick … Read more

Submitting form via admin-post.php and handling errors

Am I supposed to just do normal redirects back to my form page? Something like wp_redirect( ‘/my-page/’, 302 );? Yes. How do I display my errors on the page that has the form? Well, there are various ways, including: Passing an error code as a query string in the redirect URL: example.com/my-page/?my_form_error=tos_agree_empty. Then in your … Read more

WordPress Custom Application form

Although a premium plugin, I would like to suggest Gravity Forms (aff link). Due to conditional logic you can easily adapt the form to be(come) an application form instead of the usual contact form.

Looking for a simple approach for handling user $_POST data without AJAX?

The best way to process the custom form is the following. If you are using nonce then you don’t really have to check $_POST[‘checkbox’], the code below can be used simply to verify_nonce and then process the form. function process_my_form() { if ( wp_verify_nonce( $_POST[‘my_nonce_field’], ‘my_nonce’ ) ) { // process your form here // … Read more

Simple contact form with field validation

You don’t have any validation mechanism. Your logic should be somewhat along those lines Submit form Check submitted fields ($_POST) against expected values If all looks good send If something is not as expected, log error ( you can use WP_Error() ) and rebuild form showing error message (and maybe repopulating fields with previous “good” … Read more

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)