0

I have a table called wp_invites which contains a list of invitees. This table contains a column called reference, which is added to the URL as a query param in order to customise their invite (i.e. test.com/?ref=1e232ewf2 ).

On my page, I have an RSVP form, and the idea is to submit the form data to another custom table called wp_rsvp.

With my current approach below, whenever I submit the form, I get a 404 error:

This test.test page can’t be found
No web page was found for the web address: http://test.test/?ref=1e232ewf2
HTTP ERROR 404

I have tried leaving form action to an empty string (action=""), but no luck.

<form action="<?php get_the_permalink(); ?>" method="post">
  <fieldset class="fieldset">
    <input type="text" name="name" placeholder="Your name*" required />
  </fieldset>
  <fieldset class="fieldset">
    <input type="email" name="email" placeholder="Your email*" required />
  </fieldset>
  <fieldset class="fieldset">
    <textarea name="message"></textarea>
  </fieldset>
</form>

</php

global $wpdb;

/*
* on submit, send form data to DB
*/

if(isset($_POST['submit'])){
  insert_row();
}

/*
* get data from fields
*/

function insert_row(){

  $rsvp_table = $wpdb->prefix . 'invites';

  // get data from fields
  $name = sanitize_text_field( $_POST['name']);
  $email = sanitize_text_field( $_POST['email']);
  $message = sanitize_text_field( $_POST['message']);

  // store data in array
  $data = array(
    'form_completed_by' => $name,
    'email' => $email,
    'notes' => $message
  );

  var_dump($data);

  // set up formats for database SQL injection security
  $formats = array(
    '%s',  // form_completed_by should be an string
    '%s',
    '%s'
  );

  // Debugging: Turn on error reporting for db to see if there's a database error
  $wpdb->show_errors();

  // Actually attempt to insert the data
  $wpdb->insert($rsvp_table, $data, $formats);

}

?>

I am running all this code in one file (rsvp-form.php).

My data dumps (i.e. var_dump($data)) also show nothing. No new results in the wp_rsvp table naturally. Unsure where it's falling apart?

Latest approach

<?php $reference = ( isset( $_GET['ref'] ) ) ? sanitize_text_field( $_GET['ref'] ) : ''; ?>

<form action="<?php echo esc_url( get_the_permalink() ); ?>?<?php echo $reference; ?>" method="post">
  <input type="hidden" name="rsvp_nonce" value="<?php echo wp_create_nonce( 'rsvp_nonce' ); ?>" />
  <fieldset class="fieldset">
    <input type="text" name="name" placeholder="Your name*" required />
  </fieldset>
  <fieldset class="fieldset">
    <input type="email" name="email" placeholder="Your email*" required />
  </fieldset>
  <fieldset class="fieldset">
    <textarea name="message"></textarea>
  </fieldset>
</form>

</php

global $wpdb;

/*
* on submit, send form data to DB
*/

if(isset($_POST['submit'])){
  insert_row();
}

/*
* get data from fields
*/

function insert_row(){

  $rsvp_table = $wpdb->prefix . 'rsvp';

  // get data from fields & sanitize them
  $name = sanitize_text_field( $_POST['name']);
  $email = sanitize_text_field( $_POST['email']);
  $message = sanitize_text_field( $_POST['message']);

  // store data in array
  $data = array(
    'form_completed_by' => $name,
    'email' => $email,
    'notes' => $message
  );

  var_dump($data);

  // set up formats for database SQL injection security
  $formats = array(
    '%s',  // form_completed_by should be an string
    '%s',
    '%s'
  );

  // Debugging: Turn on error reporting for db to see if there's a database error
  $wpdb->show_errors();

  //  attempt to insert the data
  if ( ! wp_verify_nonce( $_POST['rsvp_nonce'], 'rsvp_nonce' ) ) {
    // Nonce verification failed, do not insert data
    return;
  } else {
    $wpdb->insert($rsvp_table, $data, $formats);
  }

  if ( $wpdb->last_error !== '' ) {
    // There was an error
    echo $wpdb->last_error;
  } else {
    // Success
    echo 'Data was inserted successfully';
  }

}

?>
1
  • 1
    You’re not echoing get_the_permalink(), so if you inspect the HTML you’ll see that the action parameter is empty. Dec 4, 2022 at 21:12

1 Answer 1

2

I see a few issues with the code:

First, the form action is not set correctly. It should be something like:

<form action="<?php echo esc_url( get_the_permalink() ); ?>" method="post">

In the PHP code, you are using the wrong table name. You are using the table name 'invites' instead of 'rsvp'. You should change this line:

$rsvp_table = $wpdb->prefix . 'invites';

to:

$rsvp_table = $wpdb->prefix . 'rsvp';

You need to sanitize the form input data before inserting it into the database. You should use the sanitize_text_field() function to sanitize the input data. For example:

$name = sanitize_text_field( $_POST['name']);

You should check for errors after inserting data into the database, and display an error message if there are any errors. You can do this by adding this code after the call to $wpdb->insert():

if ( $wpdb->last_error !== '' ) {
    // There was an error
    echo $wpdb->last_error;
} else {
    // Success
    echo 'Data was inserted successfully';
}

You should also consider nonce verification for security purposes. You can add a nonce field to the form and verify it before inserting data into the database. For example:

<input type="hidden" name="my_form_nonce" value="<?php echo wp_create_nonce( 'my_form_nonce' ); ?>" />

And then in the PHP code, you can verify the nonce like this:

if ( ! wp_verify_nonce( $_POST['my_form_nonce'], 'my_form_nonce' ) ) {
    // Nonce verification failed, do not insert data
    return;
}

With these changes, your code should work as expected.

2
  • Hi Nate, thanks for the pointers and apologies for the obvious mistakes I've made (such as with the table name, as you pointed out). I've implemented your pointers (have updated my question to show latest code). However, I'm still encountering a 404 when submitting the form. I've even added the query ref to action to see if that changed anything, no luck. Could it be because my local env is http? Can't see any other reasons
    – Freddy
    Dec 4, 2022 at 22:20
  • Figured it out :) The name name on one of my fields is a reserved WP keyword which was causing it to 404. Changing that allowed me to get past the 404 :)
    – Freddy
    Dec 5, 2022 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.