WordPress评论插件表单提交数据后跳转404错误求助

开发了一个基于短码的WordPress评论工具，手动向数据库插入数据可正常显示，但通过表单提交数据时，数据虽成功写入数据库，页面却跳转到“页面不存在404”页面。

相关代码如下：

index.php #

// funkce, která vytvoří tabulku wp_reviews v databázi
function create_reviews_table() {
    global $wpdb;

    $table_name = $wpdb->prefix . 'reviews';

    $charset_collate = $wpdb->get_charset_collate();

    $sql = "CREATE TABLE $table_name (
        id int NOT NULL AUTO_INCREMENT,
        name varchar(255) NOT NULL,
        email varchar(255) NOT NULL,
        rating int NOT NULL,
        description text NOT NULL,
        image varchar(255),
        created_at datetime NOT NULL,
        PRIMARY KEY (id)
    ) $charset_collate;";

    require_once(ABSPATH . 'wp-admin/includes/upgrade.php');
    dbDelta($sql);
}

// zavoláme funkci create_reviews_table() při aktivaci pluginu
register_activation_hook(__FILE__, 'create_reviews_table');



function my_enqueue() {
  wp_enqueue_script( 'my-script', plugins_url( 'js/script.js', __FILE__ ), array( 'jquery' ), '1.0.0', true );
  wp_enqueue_style( 'my-style', plugins_url( 'css/style.css', __FILE__ ), array(), '1.0.0', 'all' );

}
add_action( 'wp_enqueue_scripts', 'my_enqueue' );


function wp_reviews_shortcode() {
  ob_start();

  if (isset($_POST['submit_review'])) {
    submit_review();
  }
  ?>
  <div class="my-wrapper">
    <div class="w30">
            <?php
                if (isset($_POST['submit_my_review'])) {
                  submit_review();
                }
            ?>
        <?php include 'form.php'; ?>
        <?php include 'submit-review.php'; ?>
    </div>
    <div class="w70">
        <?php include 'reviews-list.php'; ?>
    </div>
  </div>
<?php

  return ob_get_clean();
}

add_shortcode('wp_reviews', 'wp_reviews_shortcode');

?>

form.php #

<div class="wp-reviews-form">
  <h2>Napsat recenzi</h2>
  <form method="post" enctype="multipart/form-data">

    <div>
      <label for="name">Jméno a příjmení:</label>
      <input type="text" name="name" required>
    </div>
    <div>
      <label for="email">Email:</label>
      <input type="email" name="email" required>
    </div>
    <div>
    <label for="rating">Hodnocení spolurpáce:</label>
      <select name="rating" required>
        <option value="">-- Vyberte hodnocení --</option>
        <option value="1">Hrozná</option>
        <option value="2">Ucházející</option>
        <option value="3">Dobrá</option>
        <option value="4">Super</option>
        <option value="5">Úžasná</option>
      </select>
    </div>
    <div>
      <label for="description">Popis recenze:</label>
      <textarea name="description" required></textarea>
    </div>
    <div>
      <label for="image">Nahrát obrázek:</label>
      <input type="file" name="image">
    </div>
    <div>
      <input type="submit" name="submit_my_review" value="Odeslat recenzi">
    </div>
      
  </form>
</div>

submit-review.php #

<?php

function submit_review() {
  if (isset($_POST['submit_my_review'])) {
    require_once('../../../wp-load.php');
    global $wpdb;

    $name = sanitize_text_field($_POST['name']);
    $email = sanitize_email($_POST['email']);
    $rating = intval($_POST['rating']);
    $description = sanitize_textarea_field($_POST['description']);

    $image_url = '';
    if ($_FILES['image']['size'] > 0) {
      $upload = wp_upload_bits($_FILES['image']['name'], null, file_get_contents($_FILES['image']['tmp_name']));
      if (isset($upload['error']) && $upload['error'] != 0) {
        wp_die('Nepodařilo se nahrát obrázek: ' . $upload['error']);
      } else {
        $image_url = $upload['url'];
      }
    }
    
    $table_name = $wpdb->prefix . 'reviews'; 
      
    $wpdb->insert( $table_name, array(
        'name' => $name,
        'email' => $email,
        'rating' => $rating,
        'description' => $description,
        'image' => $image_url,
        'created_at' => current_time('mysql')
      ),
      array('%s', '%s', '%d', '%s', '%s', '%s')
    );

    echo 'Review submitted successfully';

    wp_die();

  }
}

?>

1. wp_die()的错误使用：在submit_review()函数末尾调用wp_die()，会直接终止WordPress的正常执行流程，输出内容后结束程序，导致页面无法完成渲染，触发404错误。
2. 重复调用与函数重复定义：短码函数里两次判断并调用submit_review()，同时submit-review.php被包含在短码输出中，导致函数被重复定义，表单提交后逻辑执行混乱。
3. 不必要的环境引入：submit_review()中引入../../../wp-load.php，但短码运行时WordPress环境已加载，重复引入会引发环境冲突。
4. 表单提交目标异常：表单未指定action属性，默认提交到当前页面，但短码的表单处理逻辑未正确融入WordPress查询流程，导致提交后页面解析异常。

1. 重构表单处理函数 #

修改submit-review.php，移除冗余的wp-load.php引入和错误的wp_die()，改为处理完成后重定向并设置提示：

<?php
function submit_review() {
  if (!isset($_POST['submit_my_review'])) return;

  global $wpdb;

  $name = sanitize_text_field($_POST['name']);
  $email = sanitize_email($_POST['email']);
  $rating = intval($_POST['rating']);
  $description = sanitize_textarea_field($_POST['description']);

  $image_url = '';
  if ($_FILES['image']['size'] > 0) {
    $upload = wp_upload_bits($_FILES['image']['name'], null, file_get_contents($_FILES['image']['tmp_name']));
    if (isset($upload['error']) && $upload['error'] != 0) {
      wp_die('Nepodařilo se nahrát obrázek: ' . $upload['error']); // 仅在上传错误时终止
    } else {
      $image_url = $upload['url'];
    }
  }
  
  $table_name = $wpdb->prefix . 'reviews'; 
    
  $wpdb->insert( $table_name, array(
      'name' => $name,
      'email' => $email,
      'rating' => $rating,
      'description' => $description,
      'image' => $image_url,
      'created_at' => current_time('mysql')
    ),
    array('%s', '%s', '%d', '%s', '%s', '%s')
  );

  // 设置提交成功提示并重定向
  $_SESSION['review_submitted'] = true;
  wp_redirect(get_permalink());
  exit;
}
?>

2. 优化短码函数逻辑 #

修改index.php中的短码函数，简化表单调用逻辑并处理提交提示：

function wp_reviews_shortcode() {
  ob_start();

  // 处理表单提交
  if (isset($_POST['submit_my_review'])) {
    submit_review();
  }

  // 显示提交成功提示
  if (isset($_SESSION['review_submitted']) && $_SESSION['review_submitted']) {
    echo '<p class="success">Recenze byla úspěšně odeslána!</p>';
    unset($_SESSION['review_submitted']);
  }
  ?>
  <div class="my-wrapper">
    <div class="w30">
        <?php include 'form.php'; ?>
    </div>
    <div class="w70">
        <?php include 'reviews-list.php'; ?>
    </div>
  </div>
<?php

  return ob_get_clean();
}
add_shortcode('wp_reviews', 'wp_reviews_shortcode');

3. 添加安全验证（推荐） #

在form.php中添加nonce字段防止CSRF攻击：

<form method="post" enctype="multipart/form-data">
  <?php wp_nonce_field('submit_review_action', 'review_nonce'); ?>
  <!-- 原表单字段 -->
</form>

在submit_review()中验证nonce：

function submit_review() {
  if (!isset($_POST['submit_my_review']) || !wp_verify_nonce($_POST['review_nonce'], 'submit_review_action')) {
    wp_die('Neplatná žádost!');
  }
  // 剩余处理逻辑
}

4. 开启会话支持 #

在插件初始化时添加会话开启逻辑：

add_action('init', function() {
  if (!session_id()) {
    session_start();
  }
});

内容的提问来源于stack exchange，提问作者D-EVO