Building my own contact form in Wordpress. Any there any security steps I need to consider other than the typical email etc validation and maybe a captcha. I am not sending any data to the database.
asked Mar 10, 2012 at 14:23
Add a comment
|
1 Answer
You should use a nonce to protect yourself from CSRF attacks.
Even though you're not sending anything to the database, I'd suggest using some of the built in data validation functions (there is even a is_email function for you to use!) to strip out any HTML from your email. esc_html( striptags( $your_email_content ) ), for instance.
You could also throttle contact form submissions from a single IP to prevent someone from submitting the same thing many times. I don't know of any contact form plugins that do that, but the WordPress comment system show you an error page if you submit too many comments within a certain period of time.
answered Mar 10, 2012 at 15:11
-
That's very helpful, but I'm not 100% sure about where exactly to check the nonce. I suppose you put the nonce as usual in a hidden field, but then would I then check it before I sent the email (in the same way it's typically used of checking it before writing to the DB)? Commented Mar 10, 2012 at 15:29
-
I believe that this contact for is for unregistered users, so in this case nonces won't work because they are created based on current user.– MamadukaCommented Mar 10, 2012 at 15:33
-
-
@byronyasgur you check/verify nonces while retrieving post request from form, if nonce is verified you're sending data to DB or anywhere else.– MamadukaCommented Mar 10, 2012 at 15:42
-
1Just to clarify, nonces work fine for non-logged in users -- they just aren't as secure. Internally the nonce functions do use user ID, but if one isn't used,
wp_get_current_user, which will returnnullif there isn't a user. Meaning every person gets the same nonce. You could improve this, of course, by rolling your own nonce functions that identified different people via a cookie or something. Commented Mar 10, 2012 at 16:51