WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm going to make a contact form for my site, and i want to use WYSIWYG editor (wp_editor) in my form message field. Here is my question, is that safe use wp_editor in public though disable media button?

something like this: http://i.stack.imgur.com/dpspL.jpg


share|improve this question
It depends how you handle the user input. WordPress comes with a lot of sanitize function for that. – Horttcore Mar 12 '13 at 15:31
Simply I'm using below code to get it, Is something wrong? wp_editor( '', 'my_id', array( 'media_buttons' => false, 'textarea_rows' => 5, 'tinymce' => array( 'plugins' => 'wordpress' ) ) ); – vahid mohamadi Mar 12 '13 at 15:44
That just displays the form, it does not handle any database actions. – Horttcore Mar 12 '13 at 15:48
Just one more thing, When in form i changed from visual editor to text, It does in wp admin also. Is there anyway to disable it? – vahid mohamadi Mar 12 '13 at 15:54
up vote 0 down vote accepted

It should be fine and secure, as Horttcore mentioned it isn't making any database or backend changes it is simply displaying the tinymce editor. There are other plugins you could use of course but I don't see any problems doing exactly what you are doing.

To answer your other question, I believe the text/visual switch is stored in a cookie so only you would see this change and only if you switched it on the public form yourself - other people changing it on the public end won't change your settings for text/visual on the backend.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.