• Hi, I created a basic newsletter subscribe widget plugin. I was wondering if my PHP code below looks properly escaped the WP way? Am I using esc_attr() correctly here? If not, how would you change these values?

    Thanks

    <?php
    /**
     * Example Newsletter Form
     *
     * Main site: http://example.com
     * Form submission site: http://thirdparty.com
     * Form method: POST
     * Tools: WP, Bootstrap, jQuery Validator
     *
     * NOTES: This is not the full plugin code. Just wondering if I'm escaping properly in WP :)
     */
    ?>
    <form id="newsletter-subscribe-form" action="<?php echo esc_url( 'https://newsletter.thirdparty.com/subscribe' ); ?>" method="POST" role="form" data-toggle="validator">
      <div class="form-group">
        <input type="text" id="first_name" name="First_Name" value="<?php if ( isset( $_POST["First_Name"] ) ? esc_attr( $_POST["First_Name"] ) : '' ); ?>" placeholder="First Name" class="form-control" pattern="[a-zA-Z ]+" data-minlength="3" data-error="A valid First Name is required" required>
        <div class="help-block with-errors"></div>
      </div>
      <div class="form-group">
        <input type="text" id="last_name" name="Last_Name" value="<?php if ( isset( $_POST["Last_Name"] ) ? esc_attr( $_POST["Last_Name"] ) : '' ); ?>" placeholder="Last Name" class="form-control" pattern="[a-zA-Z ]+" data-minlength="3" data-error="A valid Last Name is required" required>
        <div class="help-block with-errors"></div>
      </div>
      <div class="form-group">
        <input type="email" id="email" name="Email" value="<?php if ( isset( $_POST["Email"] ) ? esc_attr( $_POST["Email"] ) : '' ); ?>" placeholder="Email Address" class="form-control" data-error="A valid Email is required" required>
        <div class="help-block with-errors"></div>
      </div>
      <div class="form-group">
        <input type="hidden" name="redirect" value="<?php echo esc_url( 'http://example.com/thank-you' ); ?>">
        <input type="Submit" value="Subscribe" class="btn btn-primary">
      </div>
    </form>
  • The topic ‘Am I sanitizing and escaping properly?’ is closed to new replies.