Jak bezpiecznie zapisać dane formularza w bazie danych WordPressa

Kod

<?php
// Hook into the form submission action
add_action('wp_ajax_wp_dudecom_save_form_data', 'wp_dudecom_save_form_data');
add_action('wp_ajax_nopriv_wp_dudecom_save_form_data', 'wp_dudecom_save_form_data');

// Function to handle form data saving
function wp_dudecom_save_form_data() {
    // Check for nonce security
    check_ajax_referer('wp_dudecom_form_nonce', 'security');

    // Sanitize and validate form data
    $name = sanitize_text_field($_POST['name']);
    $email = sanitize_email($_POST['email']);
    $message = sanitize_textarea_field($_POST['message']);

    // Validate email
    if (!is_email($email)) {
        wp_send_json_error('Invalid email address');
    }

    global $wpdb;
    $table_name = $wpdb->prefix . 'form_submissions';

    // Prepare data for insertion
    $data = array(
        'name' => $name,
        'email' => $email,
        'message' => $message,
        'submitted_at' => current_time('mysql')
    );

    // Insert data into the database
    $inserted = $wpdb->insert($table_name, $data);

    if ($inserted) {
        wp_send_json_success('Form data saved successfully');
    } else {
        wp_send_json_error('Failed to save form data');
    }

    wp_die();
}

// Create the database table on plugin/theme activation
function wp_dudecom_create_form_table() {
    global $wpdb;
    $table_name = $wpdb->prefix . 'form_submissions';

    $charset_collate = $wpdb->get_charset_collate();

    $sql = "CREATE TABLE $table_name (
        id mediumint(9) NOT NULL AUTO_INCREMENT,
        name tinytext NOT NULL,
        email text NOT NULL,
        message text NOT NULL,
        submitted_at datetime DEFAULT '0000-00-00 00:00:00' NOT NULL,
        PRIMARY KEY  (id)
    ) $charset_collate;";

    require_once(ABSPATH . 'wp-admin/includes/upgrade.php');
    dbDelta($sql);
}
register_activation_hook(__FILE__, 'wp_dudecom_create_form_table');

// Enqueue necessary scripts
function wp_dudecom_enqueue_scripts() {
    wp_enqueue_script('wp-dudecom-form-handler', get_template_directory_uri() . '/js/form-handler.js', array('jquery'), null, true);
    wp_localize_script('wp-dudecom-form-handler', 'wp_dudecom_ajax', array(
        'ajax_url' => admin_url('admin-ajax.php'),
        'nonce' => wp_create_nonce('wp_dudecom_form_nonce')
    ));
}
add_action('wp_enqueue_scripts', 'wp_dudecom_enqueue_scripts');
?>