2

I'm trying to use contact form 7 on my site.

The only server side validation that it seems to do is check if required fields have been entered.

Isn't there a danger if someone sends several MB of data through tools like tamper data?

Will I need to rewrite the plugin code to take care of validation?

Improve this question

1 Answer 1

Reset to default
1

It doesn't take much to tamper data when you use HTML forms; you don't even need a plug-in to do that. That's inherent in all HTML forms.

If you're that worried about people tampering with your data, yes, you'll need to rewrite the plug-in code to use session variables or a digital signature.

Improve this answer
3
  • Could you please explain a little about how session variables or a digital signature would help?
    – Naweed Chougle
    Commented Jun 18, 2011 at 2:08
  • @Programming: All external data cannot be trusted and must be validated once it reaches the web server to make sure it is what you expect. If you are doing something like passing important data fields in forms, that data must be validated. If you expect it to be safe from tampering, you should not pass it through the browser but should instead pass it through session variables so that it is not in the hands of the visitor/hacker.
    – two7s_clash
    Commented Jun 18, 2011 at 15:29
  • @Programming: and here's how you do it: wordpress.org/support/topic/…
    – two7s_clash
    Commented Jun 18, 2011 at 15:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.