I have a form on one of my wordpress site pages which sends mail with a php file which also validate the form details.

I was unable to figure out why it doesn't work, until i found that if i remove this line:

$site_name      = get_theme_mod( 'cz_pros_names_man' );

From the php file which sends the mail and does the form validation everything works great.

So my quetion is: Does the the get_theme_mod function suppose to work in files that are not template files? and if so what could make it not work :) ?

This is my form:

<div class="contact_body">
<input placeholder="שם" type="text" name="name" required="required" class="clientconin first"/>
<input placeholder="משפחה" type="text" name="lastname" required="required" class="clientconin"/>
<input placeholder="מייל" type="email" name="email" required="required" class="clientconin first"/>
<input placeholder="טלפון" type="text" name="phone" maxlength="15"  required="required" class="clientconin" />
<textarea placeholder="הודעה" name="message" class="textarea-field"></textarea>
<input type="hidden" name="promailto" value="<?php $thisprouserid = get_post_field( post_author, $post->ID ); $user_info = get_userdata($thisprouserid); echo $user_info->user_email; ?>">
<input type="submit" class="clietact_sbmt_btn" value="שלח" /><div class="contact_results"></div>

And this is the mail php file:


    //check if its an ajax request, exit if not
    if(!isset($_SERVER['HTTP_X_REQUESTED_WITH']) AND strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) != 'xmlhttprequest') {

        $output = json_encode(array( //create JSON data
            'text' => 'משהו לא בסדר, צור קשר עם האתר הראשי.'
        die($output); //exit script outputting json data

    //Sanitize input data using PHP filter_var().
    $site           = 'פנייה מאתר';
    $site_name      = get_theme_mod( 'cz_pros_names_man' );
    $user_name      = filter_var($_POST["user_name"], FILTER_SANITIZE_STRING);
    $user_lastname  = filter_var($_POST["user_lastname"], FILTER_SANITIZE_STRING);
    $user_email     = filter_var($_POST["user_email"], FILTER_SANITIZE_EMAIL);
    $phone_number   = filter_var($_POST["phone_number"], FILTER_SANITIZE_NUMBER_INT);
    $message        = filter_var($_POST["msg"], FILTER_SANITIZE_STRING);
    $subject        = 'פניית לקוח מהכרטיס שלך';
    $to_email       = filter_var($_POST["pro_mailto"], FILTER_SANITIZE_STRING);

    //additional php validation
    if(!filter_var($user_email, FILTER_VALIDATE_EMAIL)){ //email validation
        $output = json_encode(array('type'=>'error', 'text' => 'כתובת המייל לא תקינה!'));
    if(!filter_var($phone_number, FILTER_SANITIZE_NUMBER_FLOAT)){ //check for valid numbers in phone number field
        $output = json_encode(array('type'=>'error', 'text' => 'מספר טלפון שגוי!'));
    if(strlen($phone_number)<9){ //check emtpy message
        $output = json_encode(array('type'=>'error', 'text' => 'מספר טלפון שגוי!'));

    //email body
    $message_body = "הודעה:\r\n\r\n".$message."\r\n\r\nשם : ".$user_name." ".$user_lastname."\r\nטלפון :".$phone_number."\r\n\r\nניתן להשיב למייל זה ישירות ללקוח!" ;

    //proceed with PHP email.
    $headers .= 'From: "'.$site." ".$site_name.'"<'.$user_email.'>'."\r\n";
    $headers .= 'Reply-To: "'.$user_name." ".$user_lastname.'"<'.$user_email.'>'."\r\n";
    $headers .= 'X-Mailer: PHP/' . phpversion();

    $send_mail = mail($to_email, $subject, $message_body, $headers);

        //If mail couldn't be sent output error. Check your PHP email configuration (if it ever happens)
        $output = json_encode(array('type'=>'error', 'text' => 'משהו לא בסדר, צור קשר עם האתר הראשי.'));
        $output = json_encode(array('type'=>'message', 'text' => 'ההודעה נשלחה בהצלחה!'));


  • you are probably handling the form in a wrong way, but without more context it will be hard to say how. Please edit the question and add more context and more relevant ode – Mark Kaplun Sep 14 '16 at 8:48
  • Thanks. I did. is it better now? – Ben Sep 14 '16 at 10:21

You should never access directly theme files, form submissions, ajax, and even just get requests will be blocked at the server level by some security hardening measure.

Ignoring that for a moment, the reason your code fails is because wordpress wasn't bootstrapped and therefor there are no core functions available. It is actually not 100% fail safe process to find from a theme file where the wordpress files are installed in order to bootstrap it which is yet another reason not to attempt to do access theme files directly.

You need to decide on a "normal" wordpress url to submit to the form (the post in which the pos is?), and probably intercept it on the init hook, or use ajax and write the appropriate ajax hooks and handlers.

  • So just to make sure i understand: what i should do is create a Wordpress new page and use a template specific file (page-389.php for example) to put my php mail handler in (then send the form to that page url {"slug"} instead of a php file)? if that is what you meant so it works. is it also security safe that way? thanks! – Ben Sep 14 '16 at 16:08
  • not the only way, you can just check in you theme's function.php if an info is being posted to say the root url (or any other url) and check if it is your form – Mark Kaplun Sep 14 '16 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.