Help with forms and nonces

Question

I am trying to create a nonce to use with a (public-facing) form.

Below is my code:

function my_form() {
    if (isset($_POST['submit'])) { 

    $name = $_POST['name'];
    $description = $_POST['description'];
    $output_form = false;

        if (wp_verify_nonce($_POST['added'], 'add-item') )
        {
        //validate
        echo 'form submitted with nonce correctly';
        }

    } else {
       $output_form = true;
    }
    if ($output_form) {
    ?>
    <form method="post" action="">
        <?php wp_nonce_field('add-item','added'); ?>
            <label>Title:</label><br/>
            <input type="text" name="name" value="<?php echo $name; ?>"/><br/>
            <label>Description:</label><br />
            <textarea name="description" rows="3" cols="10"><?php echo $description; ?></textarea><br/>
            <input type="submit" name="submit" value="submit">
        </form>
    <?php
    }   

}

add_shortcode('PODS FORM', my_form);

I can see my form on my page, but when I submit (and fill it our correctly) instead of seeing my 'correct' message I am only seeing blank page.

Answer 1

You need to pass the value of the nonce field as first argument to wp_verify_nonce. So, you need to modify the nonce verification part in your code.

Also you were using form fields names that conflicts with internal wordpress query vars, you should prefix them with something unique so they do not conflict with wordpress. See following example:

function my_form() {
    if (isset($_POST['pf_submit'])) { 

    $name = $_POST['pf_name'];
    $description = $_POST['pf_description'];
    $output_form = false;

        if (isset( $_POST['pf_added'] ) && wp_verify_nonce($_POST['pf_added'], 'add-item') )
        {
        //validate
        echo 'form submitted with nonce correctly';
        }

    } else {
       $output_form = true;
       $name = "";
       $description = "";
    }
    if ($output_form) {
    ?>
    <form method="post" action="">
        <?php wp_nonce_field('add-item','pf_added'); ?>
            <label>Title:</label><br/>
            <input type="text" name="pf_name" value="<?php echo $name; ?>"/><br/>
            <label>Description:</label><br />
            <textarea name="pf_description" rows="3" cols="10"><?php echo $description; ?></textarea><br/>
            <input type="submit" name="pf_submit" value="submit">
        </form>
    <?php
    }   

}

add_shortcode('PODS FORM', my_form);