Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Building my own contact form in Wordpress. Any there any security steps I need to consider other than the typical email etc validation and maybe a captcha. I am not sending any data to the database.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You should use a nonce to protect yourself from CSRF attacks.

Even though you're not sending anything to the database, I'd suggest using some of the built in data validation functions (there is even a is_email function for you to use!) to strip out any HTML from your email. esc_html( striptags( $your_email_content ) ), for instance.

You could also throttle contact form submissions from a single IP to prevent someone from submitting the same thing many times. I don't know of any contact form plugins that do that, but the WordPress comment system show you an error page if you submit too many comments within a certain period of time.

share|improve this answer
    
That's very helpful, but I'm not 100% sure about where exactly to check the nonce. I suppose you put the nonce as usual in a hidden field, but then would I then check it before I sent the email (in the same way it's typically used of checking it before writing to the DB)? –  byronyasgur Mar 10 '12 at 15:29
    
I believe that this contact for is for unregistered users, so in this case nonces won't work because they are created based on current user. –  Mamaduka Mar 10 '12 at 15:33
    
aah yes that's the case –  byronyasgur Mar 10 '12 at 15:37
    
@byronyasgur you check/verify nonces while retrieving post request from form, if nonce is verified you're sending data to DB or anywhere else. –  Mamaduka Mar 10 '12 at 15:42
1  
Just to clarify, nonces work fine for non-logged in users -- they just aren't as secure. Internally the nonce functions do use user ID, but if one isn't used, wp_get_current_user, which will return null if there isn't a user. Meaning every person gets the same nonce. You could improve this, of course, by rolling your own nonce functions that identified different people via a cookie or something. –  chrisguitarguy Mar 10 '12 at 16:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.