Security measures built into Fillin Forge and recommendations for developers extending it.
Input Sanitization
Every submitted value is validated and then goes through FORMFORGE_Field_Types::sanitize():
| Field type | What is applied |
|---|---|
email | sanitize_email() |
url | esc_url_raw() |
textarea | sanitize_textarea_field() |
number, range | kept only if the value is numeric, otherwise empty |
rating | kept only if the value is numeric and not 0, otherwise empty |
map_address, payment, calendar_picker | sanitize_text_field() |
html_block | wp_kses_post() |
All others (text, password, select, radio, checkbox and so on) | sanitize_text_field(), applied to each item when the value is a list |
Nonce Verification
Each form carries a hidden formforge_nonce field, created with wp_create_nonce( 'formforge_submit' ). The submit handler checks it before it reads anything else from the request, and then runs the origin, rate limit, honeypot, timing and token checks (see Anti-Spam System). The admin AJAX actions of the builder use check_ajax_referer( 'formforge_nonce', 'nonce' ) instead.
wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['formforge_nonce'] ?? '' ) ), 'formforge_submit' );SQL Injection Prevention
Queries that take a value from a request use $wpdb->prepare() with placeholders:
$wpdb->get_results( $wpdb->prepare(
"SELECT * FROM {$table} WHERE form_id = %d AND status = %s",
$form_id, 'new'
) );XSS Prevention
Form output is escaped with the WordPress functions, for example:
esc_html( $field['label'] );
esc_attr( $field['id'] );
wp_kses_post( $html_content );The finished form body is also passed through wp_kses() with an allowlist of form tags.
Capability Checks
The REST routes for forms, submissions, analytics and AI generation require manage_options. The two template routes are public. POST /formforge/v1/forms/{id}/submit answers 501: a submission is accepted only through the AJAX action formforge_submit, with the nonce and the anti-spam checks. Uploaded files are stored in uploads/formforge-private (see File Upload Security).