Send WPForms Data to an External Database Safely
By George Nicolaou
This recording explores sending WPForms submissions to a separate database. The archived code illustrates the integration idea, but it is not suitable to copy directly into a production system.
What the older example needs corrected
It passes personal data in a URL, disables certificate verification and interpolates values into SQL. Those choices can expose data in logs or enable unsafe database queries. Do not publish an unauthenticated receiving script or use the example as-is for real submissions.
Design the receiving endpoint
- Use an authenticated server-to-server request over HTTPS with certificate verification enabled.
- Send only the fields needed by the receiving service, usually in a POST body rather than the query string.
- Validate allowed fields and values, then use prepared database queries.
- Keep database credentials on the server and give the integration only the permissions it requires.
- Handle retries and duplicate submissions deliberately, and avoid logging full personal data.
Test with invented data
Check success, validation failures, timeouts and duplicate requests. Decide how the user is informed if the remote service is unavailable. Include the external processing in your privacy information and retention plan.
WordPress provides guidance on escaping output; validation, authorisation and database safety are separate parts of the integration. The retained snippet is an archival teaching example.
Related guides
function wpf_george_process_complete( $fields, $entry, $form_data, $entry_id ) { // Optional, you can limit to specific forms. Below, we restrict output to
// form #5.
if ( absint( $form_data['id'] ) !== 5 ) {
return;
}
// Get the full entry object
$entry = wpforms()->entry->get( $entry_id );
// Fields are in JSON, so we decode to an array
$entry_fields = json_decode( $entry->fields, true );
// get the first name and email as a string
$FullName = $entry_fields['1']['value'];
$Email = $entry_fields['2']['value'];
// Convert back to json
$entry_fields = json_encode( $entry_fields );
// Save changes
wpforms()->entry->update( $entry_id, array( 'fields' => $entry_fields ), '', '', array( 'cap' => false ) );
//magic time start
if( ! $FullName || ! $Email ){
error_log( 'Unable to get userdata!' );
return;
}
$body = array(
'FullName' => $FullName,
'Email' => $Email
);
$url = 'https://georgiosn39.sg-host.com/savedata.php?FullName='.$FullName.'&Email='.$Email;
$args = array(
'method' => 'POST',
'timeout' => 45,
'sslverify' => false,
'headers' => array(
//'Authorization' => 'Bearer {token goes here}',
'Content-Type' => 'application/json',
),
'body' => $body,
);
$request = wp_remote_post( $url, $args );
if ( is_wp_error( $request ) || wp_remote_retrieve_response_code( $request ) != 200 ) {
error_log( print_r( $request, true ) );
}
$response = wp_remote_retrieve_body( $request );
//console_log($response);
//magic time end
}
add_action( 'wpforms_process_complete', 'wpf_george_process_complete', 10, 4 );
<?php
$servername = "localhost";
$username = "random";
$password = "whatever";
$dbname = "dbnamewhatever";
$FullName = $_GET['FullName'];
$Email = $_GET['Email'];
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}$sql = "INSERT INTO Subs (id, FullName, Email)
VALUES ('', '$FullName', '$Email')";
if ($conn->query($sql) === TRUE) {
echo "New record created successfully";
} else {
echo "Error: " . $sql . "<br>" . $conn->error;
}
$conn->close();
?>
0 Comments