WordPress Form Submissions: A Comprehensive Guide to Effectively Handle and Optimize User Input

To handle form submissions in WordPress, you can use the admin_post and admin_post_nopriv hooks. These hooks allow you to create custom actions that are triggered when a form is submitted. Here's a step-by-step guide:

Create the Form:
Create the HTML form in your WordPress theme or plugin. For example, you might place this form in a template file or within a page or post using a shortcode.

// Your form in a template file or shortcode
echo '<form action="' . admin_url('admin-post.php') . '" method="post">
       <input type="hidden" name="action" value="my_custom_form_action">
       <input type="text" name="data_field" placeholder="Enter data">
       <input type="submit" value="Submit">
     </form>';

Handle Form Submissions:
In your theme's functions.php file or your custom plugin file, create a function to handle the form submissions. Hook this function to the admin_post and admin_post_nopriv actions.

// functions.php or your custom plugin file
// Hook to handle form submissions for logged-in users
add_action('admin_post_my_custom_form_action', 'handle_form_submission');
// Hook to handle form submissions for non-logged-in users
add_action('admin_post_nopriv_my_custom_form_action', 'handle_form_submission');
function handle_form_submission() {
   // Check if the form nonce is valid (optional but recommended for security)
   if (isset($_POST['_wpnonce']) && wp_verify_nonce($_POST['_wpnonce'], 'my_custom_form_nonce')) {
       // Process form data here
       $data_field_value = sanitize_text_field($_POST['data_field']);
       // Perform your actions with the form data (e.g., save to the database)
       // Redirect after form submission
       wp_redirect(home_url('/thank-you/'));
       exit();
   } else {
       // Nonce verification failed
       wp_die('Security check failed');
   }
}

Add Nonce Field to the Form:
For security, include a nonce field in your form to protect against Cross-Site Request Forgery (CSRF) attacks.

// Your form in a template file or shortcode
echo '<form action="' . admin_url('admin-post.php') . '" method="post">
       <input type="hidden" name="action" value="my_custom_form_action">
       ' . wp_nonce_field('my_custom_form_nonce', '_wpnonce', true, false) . '
       <input type="text" name="data_field" placeholder="Enter data">
       <input type="submit" value="Submit">
     </form>';

Make sure to customize the form action, field names, and processing logic according to your specific needs. This example provides a basic structure for handling form submissions in WordPress.