将Google表单的服务器端验证复制粘贴到WordPress页面

Question

I embedded a Google Form in my WordPress site by copy-pasting its source code into the page. Will I need "server side validation" for a Google Form?

Data submitted to Google Form is sent to Google Drive, therefore malicious code cannot harm my website - am I wrong? (Just to be extra clear...is data submitted to Google Form sent to my WordPress database?)

I am using some client side validation:

<input type="email" required="required" /> 

Edit

One more question. As long as the action has google's link

<form action="google form link"> 

then I am safe? So if I leave the action blank then it is no longer a Google Form, and data will be sent to my WordPress database?

Answer 1

I would discourage you from copy-pasting the Google Form into your WordPress page, because then you run the risk of Google changing something in their form processing code in the future, so that your form will no longer submit properly. The supported way is to use the embed code provided by Google which uses an <iframe> tag to insert the form into your page.

To answer the actual question: since the action parameter of the <form> tag determines which URL the input data will be submitted to, if that URL points to Google's servers, then the data will not reach your server, and therefore you do not need to validate it on the server side.

If you leave the action parameter blank, the data will be sent to the current URL (your WordPress page), but since WordPress is not prepared to handle Google Form submissions, it will silently discard your data. Therefore it will not be saved to your WordPress database.