Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm trying to use contact form 7 on my site.

The only server side validation that it seems to do is check if required fields have been entered.

Isn't there a danger if someone sends several MB of data through tools like tamper data?

Will I need to rewrite the plugin code to take care of validation?

share|improve this question

put on hold as off-topic by birgire, kaiser 20 hours ago

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

up vote 1 down vote accepted

It doesn't take much to tamper data when you use HTML forms; you don't even need a plug-in to do that. That's inherent in all HTML forms.

If you're that worried about people tampering with your data, yes, you'll need to rewrite the plug-in code to use session variables or a digital signature.

share|improve this answer
    
Could you please explain a little about how session variables or a digital signature would help? –  Enthusiast Jun 18 '11 at 2:08
    
@Programming: All external data cannot be trusted and must be validated once it reaches the web server to make sure it is what you expect. If you are doing something like passing important data fields in forms, that data must be validated. If you expect it to be safe from tampering, you should not pass it through the browser but should instead pass it through session variables so that it is not in the hands of the visitor/hacker. –  two7s_clash Jun 18 '11 at 15:29
    
@Programming: and here's how you do it: wordpress.org/support/topic/… –  two7s_clash Jun 18 '11 at 15:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.