WordPress自定义插件表单数据无法插入MySQL数据库求助

我开发了一款WordPress自定义插件，实现激活时自动在MySQL数据库创建数据表，停用插件时删除该表。目前数据表可正常创建，但用户填写表单提交后，数据无法插入数据库。以下是插件核心代码文件：

第一个代码文件（主插件文件） #

<?php
/*
 * Plugin Name:       NFTP Get Quote
 * Plugin URI:        https://example.com/plugins/the-basics/
 * Description:       Handle the basics with this plugin.
 * Version:           1.10.3
 * Requires at least: 5.2
 * Requires PHP:      7.2
 * Author:            Isha Bhutto
 * Author URI:        https://www.upwork.com/freelancers/~01a72e9e83e6dd47a2
 * License:           GPL v2 or later
 * License URI:       https://www.gnu.org/licenses/gpl-2.0.html
 * Update URI:        https://example.com/my-plugin/
 * Text Domain:       nftp_get_quote
 * Domain Path:       /languages
 */

if (function_exists('ngq_get_quote_form')) {

} else {
    function ngq_get_quote_form()
    {
        $actual_link = "http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
        ob_start();
        ?>
        <!DOCTYPE html>
        <html>
        <head>
            <title>Get a Quote</title>
        </head>
        <body>
            <div class="form-container">
                <h2>Get a Quote</h2>
                <form action="<?php echo plugins_url('form_submittion.php', __FILE__); ?>" method="post">
                    <input type="hidden" name="current_path" value="<?php echo $actual_link; ?>">
                    <label for="name">Your Name</label>
                    <input type="text" id="name" name="name" placeholder="Enter your name" required>

                    <label for="email">Your Email</label>
                    <input type="email" id="email" name="email" placeholder="Enter your email" required>

                    <label for="message">Message</label>
                    <textarea id="message" name="message" placeholder="Enter your message" rows="4" required></textarea>

                    <button type="submit" name="quote-submit">Submit</button>
                </form>
            </div>
        </body>
        </html>
        <?php
        return ob_get_clean();
    }
}

add_shortcode("nftp_get_quote_form", "ngq_get_quote_form");

// ADD CSS FILE
function utm_user_scripts()
{
    $plugin_url = plugin_dir_url(__FILE__);
    wp_enqueue_style('nftp_get_quote', $plugin_url . "style.css");
}
add_action('wp_enqueue_scripts', 'utm_user_scripts');

// ADD HOOKS
register_activation_hook(__FILE__, 'activate');
register_deactivation_hook(__FILE__, 'deactivate');

function activate()
{
    global $wpdb;
    $table = $wpdb->prefix . 'quotetable';

    // 检查表是否存在，不存在则创建
    if ($wpdb->get_var("show tables like '$table'") != $table) {
        $sql1 = "CREATE TABLE $table (
            `sno` int(11) NOT NULL,
            `name` varchar(100) NOT NULL,
            `email` varchar(100) NOT NULL,
            `msg` text NOT NULL
          ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;";

        $sql2 = "ALTER TABLE $table 
        ADD PRIMARY KEY (`sno`);";

        $sql3 = "ALTER TABLE $table 
        MODIFY `sno` int(11) NOT NULL AUTO_INCREMENT;";

        $wpdb->query($sql1);
        $wpdb->query($sql2);
        $wpdb->query($sql3);
    }
}

function deactivate()
{
    global $wpdb;
    $table = $wpdb->prefix . 'quotetable';
    $sql = "DROP TABLE $table";
    $wpdb->query($sql);
}
?>

第二个代码文件（form_submittion.php） #

<?php 
require ('../../../wp-load.php');

global $wpdb;
$table = $wpdb->prefix . 'quotetable';

if (isset($_POST['quote-submit'])) {
    $name = $_POST['name'];
    $email = $_POST['email'];
    $msg = $_POST['message'];

    $wpdb->insert($table, Array('name' => $name, 'email' => $email, 'message' => $msg));

    $current_path = $_POST['current_path'];
    ?>
    <script>
        window.location = '<?php  echo $current_path;?>';
    </script>
    <?php    
}
?>

问题原因及修复方案 #

1. 核心错误：字段名不匹配 #

创建数据表时，消息字段的名称是msg，但插入数据时用的是message，两者不一致导致数据无法写入。直接修改form_submittion.php中的插入语句即可：

$wpdb->insert($table, Array('name' => $name, 'email' => $email, 'msg' => $msg));

2. 优化提交方式（推荐） #

直接加载wp-load.php不是WordPress规范的做法，存在安全风险，建议改用admin-post动作处理提交：

• 修改主插件文件中的表单action：

  <form action="<?php echo admin_url('admin-post.php'); ?>" method="post">
      <input type="hidden" name="action" value="nftp_submit_quote">
      <?php wp_nonce_field('nftp_quote_submit', 'nftp_quote_nonce'); ?>
      <!-- 其他字段保持不变 -->
  </form>
  

• 删除form_submittion.php，在主插件文件中添加提交处理函数：

  function nftp_handle_quote_submission() {
      if (!isset($_POST['quote-submit'])) return;
      // 安全验证
      if (!wp_verify_nonce($_POST['nftp_quote_nonce'], 'nftp_quote_submit')) {
          wp_die('安全验证失败');
      }
      global $wpdb;
      $table = $wpdb->prefix . 'quotetable';
      // 清理用户输入
      $name = sanitize_text_field($_POST['name']);
      $email = sanitize_email($_POST['email']);
      $msg = sanitize_textarea_field($_POST['message']);
      // 插入数据
      $wpdb->insert($table, [
          'name' => $name,
          'email' => $email,
          'msg' => $msg
      ]);
      // 跳转回原页面
      wp_redirect($_POST['current_path']);
      exit;
  }
  add_action('admin_post_nftp_submit_quote', 'nftp_handle_quote_submission');
  add_action('admin_post_nopriv_nftp_submit_quote', 'nftp_handle_quote_submission');
  

3. 数据安全优化 #

添加输入清理和验证，避免SQL注入和恶意内容提交，上述优化代码中已包含sanitize_text_field、sanitize_email等处理函数。

内容的提问来源于stack exchange，提问作者Isha Bhutto