I'm going to make a contact form for my site, and i want to use WYSIWYG editor (wp_editor) in my form message field. Here is my question, is that safe use wp_editor in public though disable media button?

something like this: https://i.sstatic.net/dpspL.jpg


  • It depends how you handle the user input. WordPress comes with a lot of sanitize function for that.
    – Horttcore
    Commented Mar 12, 2013 at 15:31
  • Simply I'm using below code to get it, Is something wrong? wp_editor( '', 'my_id', array( 'media_buttons' => false, 'textarea_rows' => 5, 'tinymce' => array( 'plugins' => 'wordpress' ) ) ); Commented Mar 12, 2013 at 15:44
  • That just displays the form, it does not handle any database actions.
    – Horttcore
    Commented Mar 12, 2013 at 15:48
  • Just one more thing, When in form i changed from visual editor to text, It does in wp admin also. Is there anyway to disable it? Commented Mar 12, 2013 at 15:54

1 Answer 1


It should be fine and secure, as Horttcore mentioned it isn't making any database or backend changes it is simply displaying the tinymce editor. There are other plugins you could use of course but I don't see any problems doing exactly what you are doing.

To answer your other question, I believe the text/visual switch is stored in a cookie so only you would see this change and only if you switched it on the public form yourself - other people changing it on the public end won't change your settings for text/visual on the backend.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.