wp_nonce_field displaying twice

Question

I have wp_nonce_field in my code but it's creating two instances to the html code for some reason, one where I'd expect it and another at the start of the entry. Is this correct or am I doing somehthing wrong. It's creating a validator error. One thing I'm doing a bit different is that the form is being output via a shortcode, but I wouldnt have expected that to cause a problem. I have checked the rest of the code and it is the case the wp_nonce_field is "working twice" for some reason ... here is the relevant portion of the code

      (rest of form code precedes this)      
      $formDisplay .= $commentErrorDisplay;
      $formDisplay .= '<input id="submitContact" type="submit" value = "Send" />';
      $formDisplay .= wp_nonce_field('contact-form');
      $formDisplay .= '<input type="hidden" name="contact-submitted" id="contact-submitted" value="true" />';
      $formDisplay .= '<br /><span class="feedback ' . $sent .'">'.$feedback.'</span>';
      $formDisplay .= '</form>';
      $formDisplay .= '</div>';


      return $formDisplay;

Edit : I think I've discovered it, though in fact I still dont fully understand, but that's probably just a general lack of knowledge on my part. The codex says

Return Values (string) Nonce field.

so I thought that meant that as it returned a nonce field as a string that I could just append it to $formDisplay ( 3rd line of my code) but apparently not. I think it must both display the nonce field AND return it or something. I'm sure there's nothing strange about it's operation but it's probably worth leaving this question up here just in case someone else falls for the same mistake.

Answer 1

If you're going to add the nonce field to an HTML string, you have to specify that you don't want it echoed. That's the fourth parameter; see https://core.trac.wordpress.org/browser/tags/3.3.1/wp-includes/functions.php#L1952

$formDisplay .= wp_nonce_field( 'contact-form', '_wpnonce', true, false );

Answer 2

Noticed this in validation checking like OP. The fix is dead-on as Boone suggested, however in my instance of using a guest-post plugin, changing the 4th value to false wouldn't let me change the post status from plugin default (pending). My fix I found was to change the line directly underneath in wp-includes/function.php to "class" instead of "id".

... Wordpress and posting still seems to work correctly.