0

I'm going to make a contact form for my site, and i want to use WYSIWYG editor (wp_editor) in my form message field. Here is my question, is that safe use wp_editor in public though disable media button?

something like this: http://i.stack.imgur.com/dpspL.jpg

Thanks.

  • It depends how you handle the user input. WordPress comes with a lot of sanitize function for that. – Horttcore Mar 12 '13 at 15:31
  • Simply I'm using below code to get it, Is something wrong? wp_editor( '', 'my_id', array( 'media_buttons' => false, 'textarea_rows' => 5, 'tinymce' => array( 'plugins' => 'wordpress' ) ) ); – vahid mohamadi Mar 12 '13 at 15:44
  • That just displays the form, it does not handle any database actions. – Horttcore Mar 12 '13 at 15:48
  • Just one more thing, When in form i changed from visual editor to text, It does in wp admin also. Is there anyway to disable it? – vahid mohamadi Mar 12 '13 at 15:54
0

It should be fine and secure, as Horttcore mentioned it isn't making any database or backend changes it is simply displaying the tinymce editor. There are other plugins you could use of course but I don't see any problems doing exactly what you are doing.

To answer your other question, I believe the text/visual switch is stored in a cookie so only you would see this change and only if you switched it on the public form yourself - other people changing it on the public end won't change your settings for text/visual on the backend.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.