Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have wp_nonce_field in my code but it's creating two instances to the html code for some reason, one where I'd expect it and another at the start of the entry. Is this correct or am I doing somehthing wrong. It's creating a validator error. One thing I'm doing a bit different is that the form is being output via a shortcode, but I wouldnt have expected that to cause a problem. I have checked the rest of the code and it is the case the wp_nonce_field is "working twice" for some reason ... here is the relevant portion of the code

      (rest of form code precedes this)      
      $formDisplay .= $commentErrorDisplay;
      $formDisplay .= '<input id="submitContact" type="submit" value = "Send" />';
      $formDisplay .= wp_nonce_field('contact-form');
      $formDisplay .= '<input type="hidden" name="contact-submitted" id="contact-submitted" value="true" />';
      $formDisplay .= '<br /><span class="feedback ' . $sent .'">'.$feedback.'</span>';
      $formDisplay .= '</form>';
      $formDisplay .= '</div>';


      return $formDisplay;

Edit : I think I've discovered it, though in fact I still dont fully understand, but that's probably just a general lack of knowledge on my part. The codex says

Return Values (string) Nonce field.

so I thought that meant that as it returned a nonce field as a string that I could just append it to $formDisplay ( 3rd line of my code) but apparently not. I think it must both display the nonce field AND return it or something. I'm sure there's nothing strange about it's operation but it's probably worth leaving this question up here just in case someone else falls for the same mistake.

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

If you're going to add the nonce field to an HTML string, you have to specify that you don't want it echoed. That's the fourth parameter; see https://core.trac.wordpress.org/browser/tags/3.3.1/wp-includes/functions.php#L1952

$formDisplay .= wp_nonce_field( 'contact-form', '_wpnonce', true, false );
share|improve this answer
    
Thanks, that's the ticket alright. I shouldn't have missed that. It's right there in the codex page. Too many late nights. –  byronyasgur Mar 16 '12 at 20:17
add comment

Noticed this in validation checking like OP. The fix is dead-on as Boone suggested, however in my instance of using a guest-post plugin, changing the 4th value to false wouldn't let me change the post status from plugin default (pending). My fix I found was to change the line directly underneath in wp-includes/function.php to "class" instead of "id".

... Wordpress and posting still seems to work correctly.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.