Fillin Forge validates and sanitizes every submission on the server, whatever the browser did. There is no filter to add your own rules or to change how a value is sanitized.
What is checked
- Required fields. Fields hidden by conditional logic are skipped and are not saved.
- The format of each value, by field type (
FORMFORGE_Field_Types::validate()). - Uploads: the file type and the size limit of the field. The default limit is 10 MB, a field can raise it to 100 MB at most, and some types are always refused: SVG, HTML, XML, PHP and other scripts, and executables.
Checking more than the built-in rules
Listen to formforge/submission_created (see Submission Hooks). It fires after the submission is saved, so it can react, for example by sending an alert or flagging the entry in your own system, but it cannot reject the submission.