Can't send form data to wpdb when URL has query string

Question

I have a table called wp_invites which contains a list of invitees. This table contains a column called reference, which is added to the URL as a query param in order to customise their invite (i.e. test.com/?ref=1e232ewf2 ).

On my page, I have an RSVP form, and the idea is to submit the form data to another custom table called wp_rsvp.

With my current approach below, whenever I submit the form, I get a 404 error:

This test.test page can’t be found
No web page was found for the web address: http://test.test/?ref=1e232ewf2
HTTP ERROR 404

I have tried leaving form action to an empty string (action=""), but no luck.

<form action="<?php get_the_permalink(); ?>" method="post">
  <fieldset class="fieldset">
    <input type="text" name="name" placeholder="Your name*" required />
  </fieldset>
  <fieldset class="fieldset">
    <input type="email" name="email" placeholder="Your email*" required />
  </fieldset>
  <fieldset class="fieldset">
    <textarea name="message"></textarea>
  </fieldset>
</form>

</php

global $wpdb;

/*
* on submit, send form data to DB
*/

if(isset($_POST['submit'])){
  insert_row();
}

/*
* get data from fields
*/

function insert_row(){

  $rsvp_table = $wpdb->prefix . 'invites';

  // get data from fields
  $name = sanitize_text_field( $_POST['name']);
  $email = sanitize_text_field( $_POST['email']);
  $message = sanitize_text_field( $_POST['message']);

  // store data in array
  $data = array(
    'form_completed_by' => $name,
    'email' => $email,
    'notes' => $message
  );

  var_dump($data);

  // set up formats for database SQL injection security
  $formats = array(
    '%s',  // form_completed_by should be an string
    '%s',
    '%s'
  );

  // Debugging: Turn on error reporting for db to see if there's a database error
  $wpdb->show_errors();

  // Actually attempt to insert the data
  $wpdb->insert($rsvp_table, $data, $formats);

}

?>

I am running all this code in one file (rsvp-form.php).

My data dumps (i.e. var_dump($data)) also show nothing. No new results in the wp_rsvp table naturally. Unsure where it's falling apart?

Latest approach

<?php $reference = ( isset( $_GET['ref'] ) ) ? sanitize_text_field( $_GET['ref'] ) : ''; ?>

<form action="<?php echo esc_url( get_the_permalink() ); ?>?<?php echo $reference; ?>" method="post">
  <input type="hidden" name="rsvp_nonce" value="<?php echo wp_create_nonce( 'rsvp_nonce' ); ?>" />
  <fieldset class="fieldset">
    <input type="text" name="name" placeholder="Your name*" required />
  </fieldset>
  <fieldset class="fieldset">
    <input type="email" name="email" placeholder="Your email*" required />
  </fieldset>
  <fieldset class="fieldset">
    <textarea name="message"></textarea>
  </fieldset>
</form>

</php

global $wpdb;

/*
* on submit, send form data to DB
*/

if(isset($_POST['submit'])){
  insert_row();
}

/*
* get data from fields
*/

function insert_row(){

  $rsvp_table = $wpdb->prefix . 'rsvp';

  // get data from fields & sanitize them
  $name = sanitize_text_field( $_POST['name']);
  $email = sanitize_text_field( $_POST['email']);
  $message = sanitize_text_field( $_POST['message']);

  // store data in array
  $data = array(
    'form_completed_by' => $name,
    'email' => $email,
    'notes' => $message
  );

  var_dump($data);

  // set up formats for database SQL injection security
  $formats = array(
    '%s',  // form_completed_by should be an string
    '%s',
    '%s'
  );

  // Debugging: Turn on error reporting for db to see if there's a database error
  $wpdb->show_errors();

  //  attempt to insert the data
  if ( ! wp_verify_nonce( $_POST['rsvp_nonce'], 'rsvp_nonce' ) ) {
    // Nonce verification failed, do not insert data
    return;
  } else {
    $wpdb->insert($rsvp_table, $data, $formats);
  }

  if ( $wpdb->last_error !== '' ) {
    // There was an error
    echo $wpdb->last_error;
  } else {
    // Success
    echo 'Data was inserted successfully';
  }

}

?>

Answer 1

I see a few issues with the code:

First, the form action is not set correctly. It should be something like:

<form action="<?php echo esc_url( get_the_permalink() ); ?>" method="post">

In the PHP code, you are using the wrong table name. You are using the table name 'invites' instead of 'rsvp'. You should change this line:

$rsvp_table = $wpdb->prefix . 'invites';

to:

$rsvp_table = $wpdb->prefix . 'rsvp';

You need to sanitize the form input data before inserting it into the database. You should use the sanitize_text_field() function to sanitize the input data. For example:

$name = sanitize_text_field( $_POST['name']);

You should check for errors after inserting data into the database, and display an error message if there are any errors. You can do this by adding this code after the call to $wpdb->insert():

if ( $wpdb->last_error !== '' ) {
    // There was an error
    echo $wpdb->last_error;
} else {
    // Success
    echo 'Data was inserted successfully';
}

You should also consider nonce verification for security purposes. You can add a nonce field to the form and verify it before inserting data into the database. For example:

<input type="hidden" name="my_form_nonce" value="<?php echo wp_create_nonce( 'my_form_nonce' ); ?>" />

And then in the PHP code, you can verify the nonce like this:

if ( ! wp_verify_nonce( $_POST['my_form_nonce'], 'my_form_nonce' ) ) {
    // Nonce verification failed, do not insert data
    return;
}

With these changes, your code should work as expected.