Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Thanks to a variety of posts on here I've managed to put together a front end submission form. After about 24 hours of tweaking I've finally got everything working including a redirect to a 'success' page after submission, but I have no idea what to do with the nonce.

Here is the form page: http://pastebin.com/YWyXL3jY

And here is the success page: http://pastebin.com/3Usu0Pt6

They are both custom page templates (I know the formatting is a bit all over the place at the moment as different parts came from different sources, and I don't think I'm going to use the file upload feature as I'd rather use a plugin for better security).

Does the nonce need to be processed before the user is redirected to the success page? I have no experience at all with nonce's and am a 'copy and paste' php coder so please be gentle!

Huge thanks for any advice you can give :)

share|improve this question
    
Is it ok to bump my questions? I have tried adding the verify_nonce directly under the if( 'POST' == $_SERVER['REQUEST_METHOD'] && !empty( $_POST['action'] )) { - it didn't seem to do anything –  Jo_pinkish Aug 29 '12 at 11:06
add comment

2 Answers

Use this for naunce and verification.

wp_nonce_field('test_action', 'submit_post');

This will generate the nounce field and you can verify with bellow code.

 if(wp_verify_nonce($_REQUEST['test_action'], 'submit_post')){
           /// do your work
  }else{
         /// throw an error
  }
share|improve this answer
add comment

Starting with this page: http://codex.wordpress.org/WordPress_Nonces

Then looking at usage for wp_verify_nonce and the example usage of wp_nonce_field, you must check the result of the verification and decide what to do (typically die, but in your case probably echo a failure message). You could probably just use the verification as your "check if the form was submitted" at line 8:

if ( empty($_POST) || wp_verify_nonce($_POST['name_of_nonce_field'],'name_of_my_action') ) {
    /* failure */
} else {
    /* success, processing, redirect */
}

Assuming the response is a success, then you would perform your next action -- like displaying a confirmation message, or in your case redirecting the page. Just make sure you redirect before any output has been printed.

Something to consider as well -- http://kovshenin.com/2012/nonces-on-the-front-end-is-a-bad-idea/ -- although in this case since you're creating content I believe the guy mentions it's "correct" to nonce.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.