2
Yes, nonces should always be used when an authenticated user is triggering an action via a GET/POST request. One of the main purposes of the nonce is it ensure that the current user actually intended to trigger this request. It prevents the security vulnerability known as Cross-Site Request Forgery (CSRF), where an attacker can trick an authenticated user ...
1
What you'd need to do is double-escape, so change echo '\'' . $term->name . '\', '; to echo '\\\'' . $term->name . '\\\', ';
...but, you'd be much better off just using different encapsulators:
<select class="w-100" name="mf_term">
<option value="
<?php
$terms = get_terms( 'call-type' );
if ( ! empty( $terms ) && ! is_wp_error( $...
1
Why the ?pgggo-taxon-select%5B%5D=14&pgggo-taxon-select%5B%5D=1 in the URL
There are three common reasons why would one see that upon submitting the form:
The form's method is post (which corresponds to the HTTP POST method) and either:
a) The current page indeed has that string in the URL. E.g. You're on example.com/my-page/?pgggo-taxon-select%5B%5D=...
Only top voted, non community-wiki answers of a minimum length are eligible
