Receiving tons of fake subscription emails

Mind sharing a link to the signup form so I can have a look?

OK, I am seeing some errors on that page which should probably be addressed. If you load the page and check the Javascript console you’ll see that 3 plugin files are generating 500’s. Not sure what the problem is there. You may see something in your PHP error log, but likely not, as the files are Javascript and CSS.

As to the spurious emails, I don’t see anything that would cause this, but I do have a fix for one of the files that I think will help.

In the files classes/PDb_Signup.class.php on line 91, you’ll find:

$this->submitted = true;
$this->participant_values = Participants_Db::get_participant( $this->participant_id );

Replace that with this:

$this->participant_values = Participants_Db::get_participant( $this->participant_id );
if ($this->participant_values) $this->submitted = true;

Let me know if that doesn’t help.

OK, well wat’s going on is this: when a web page with either the [pdb_signup] or [pdb_signup_thanks] on it is loaded, it checks for a variable named ‘id’ in the URL. This is how it knows that a successful submission has just been made, and uses that ID to send out the email notice.

What you have going on on that website (although I don’t see it) is that a variable named “id” is in the $_GET array when the page is loaded, and if it matches a record, it sends out the notification. It’s partly my fault for using such a generic variable name, but it hasn’t been a problem so far…most of the time, the URL is free of spurious variables. You need to go in and see how that page is getting requested with an ‘id’ variable in the URL.

I suspect the slider since you have so many coming in. Best way to fix this probably, (although I hate to recommend this because you’ll lose it on the next update) is to change the name of the variable. You can do this by making a couple of edits:

First, in participants-database.php line 1953 find:

wp_redirect($_POST['thanks_page'] . $conj . 'id=' . $_POST['id']);

Change that to:

wp_redirect($_POST['thanks_page'] . $conj . 'pdbid=' . $_POST['id']);

See: we just changes the name of the variable from ‘id’ to ‘pdbid’ which we can assume is not conflicted. Now, in the file classes/PDb_Signup.class.php on line 88 find:

if ( isset( $_GET['id'] ) ) {

      $this->participant_id = $_GET['id'];

We replace the name of the id with the new name like this:

if ( isset( $_GET['pdbid'] ) ) {

      $this->participant_id = $_GET['pdbid'];

That’s it. In the next update, it won’t work like this, but there is a way to customize the name of that variable in case there is a conflict, such as with your website. You’ll have to make that change when you update the plugin.