All, I've got two wordpress pages. One wordpress page displays a form to do some registration stuff for the website. The second wordpress page actually processes the data and inserts it into a custom MySQL table that I have. I'd like to use the nonce functionality inherit to Wordpress. The user doesn't have to be a Wordpress admin or have any type of permissions to be able to do it.

Can anyone give me an example or show me how to do this outside of the WP Admin in a Wordpress page?

Thanks for any advice in advance!


Nonces are not tied to the admin interface. This codex page explains them very well. Essentially, you add :

<?php wp_nonce_field('name_of_my_action', 'name_of_nonce_field'); ?>

in your form (this creates a hidden input field containing an one-time-use token). And where you're doing the form processing you just check if the nonce is correct

if(!wp_verify_nonce($_POST['name_of_nonce_field'], 'name_of_my_action')){
  // no permissions
  • If I'm doing the form processing directly in a page (so say my page name is regsiter) and my form processor is save-register which is another page in my Wordpress. How would I name this since I don't have an action to process this? – user1048676 Feb 28 '12 at 21:23
  • The nonce 'action' isn't tied to a WordPress hook, its simply meant to be a unique string that's used along with the current timestamp to generate a random string which can then be checked later to make sure the request was recent and came from the proper place. So just make up a name for your action. – goldenapples Feb 28 '12 at 21:28
  • 1
    If you're doing this to protect users from CSRF then nonces may not be the best way to go. As far as I know WP doesn't remove the nonce once it's validated, it keeps it for 24 hours or something like that, so theoretically the same form can be submitted again within that period. A better way would be to generate a random code in each page request yourself and store it in a transient, which you remove after form submission (give it ~10 minute expiration time). If you go this way, you should also clean up your transients periodically to avoid db bloat. Or easier - use sessions for storage... – onetrickpony Feb 28 '12 at 22:12
  • @OneTrickPony Would you only do this for inserts? Would you do it for selects only? – user1048676 Feb 29 '12 at 0:16
  • I'd do it only for sensitive operations. Like the site user buying things. For example user buys 1 pizza, then someone hacks his computer, steals his cookies or whatever. You don't want that hacker to use those cookies to buy another 100 pizzas because most likely he won't pay you for them :) Or think about users behind public computers. Anyway, selecting data from the db usually doesn't involve these kind of stuff... Only use nonces/one-time-tokens when you need them, because they affect your site performance too – onetrickpony Feb 29 '12 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.