Already asked this on Code Review but no answer there so that's why i'm trying here.

I'm kinda new to form sanitization and validation. If someone could look at my code and tell me where i could do things better, i'd appreciate it a lot.

Here's my form:

    <div class="inquire-form">
        <form action="<?php echo esc_url( admin_url('admin-post.php') ); ?>" method="post">
            <label for="fullname">Full Name</label>

            <input type="text" class="form-control" name="fullname" 
id="fullname" required>
            <label for="email">Email Address</label>
            <input type="email" class="form-control" name="email" id="email" required>
            <label for="subject">Subject</label>
            <input type="text" class="form-control" name="subject" id="subject" required>
            <label for="message">Your Message</label>
            <textarea name="message" class="form-control" id="message" required></textarea>
            <br />
            <input type="hidden" name="action" value="inquiry_form">
            <input type="submit" value="Send My Message" class="btn pull-right">

And here's my php:

//Handle e-mail form on inquiry template
function send_inquiry_form() {

//user posted variables
$name = sanitize_text_field($_POST['fullname']);
//check if email is a valid email adress
if (is_email($_POST['email'])) {
    $email = sanitize_email($_POST['email']);
} else {
    //Display message here, make later
    echo "Derp";

//Check if subject was filled in and if not, make custom subject
if ($_POST['subject']) {
$subject = sanitize_text_field($_POST['subject']); 
} else {
    $subject = "Someone sent a message from ".get_bloginfo('name');

$message = sanitize_text_field($_POST['message']);

//php mailer variables
$to = get_option('admin_email');    
$headers = 'From: '. $email . "\r\n" .
           'Reply-To: ' . $email . "\r\n";

// send message using wp_mail function.
$sent_message = wp_mail( $to, $subject, $message, $headers );
//display message based on the result.
if ( $sent_message ) {
    // The message was sent, redirecting for now, insert AJAX later
    wp_redirect( '/inquire' );
} else {
    // The message was not sent, redirecting for now, insert AJAX later
    wp_redirect('/404' );
add_action( 'admin_post_nopriv_inquiry_form', 'send_inquiry_form' );
add_action( 'admin_post_inquiry_form', 'send_inquiry_form' );

There are 3 unfinished things in there. But i know how to handle those.

  • 1
    sanitize_text_field required a string to work but you don't check if the user submitted it. Also, I don't see a nonce field there. – Drupalizeme Sep 26 '17 at 13:43
  • 1
    + I don't recommend the from address be populated with the email user provided unless you can indeed verify the originality. Depending on the server settings it may also be marked as spam and blocked as it may require an SMPT Authentication. – Drupalizeme Sep 26 '17 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.