keep digging and you will find …

sometimes hard to believe what you find, but unfortunately it is what it is . . .

imagine, a CMS of the size of wp doesn’t have a proper and secure comment form validation, the bad part is, it is no imagination, it is fact . . .

the validate the user name length to 200 characters long, hilarious, then, they permit everything to go in there, html code, links, all shit of the world, how absurd is that?

so now tell me, find a plugin which does it and pay for it . . . yeaaaaaah, that’s modern materialistic fugger style . . .

also no native way to limit the comment input to text, so everybody can spam your site with links to porn, to bitcoin scams and whatever . . .

got it? then get it . . .

right here to stop the shit, put this snippet into your theme’s functions.php and ready, it's free!


add_filter('preprocess_comment', function($commentdata) {   $errors = [];   if (isset($commentdata['comment_author']) && strlen($commentdata['comment_author']) > 25) {   $errors[] = 'Author name must be 25 characters or less.';   }   if (isset($commentdata['comment_author']) && !preg_match('/^[a-zA-Zs]+$/', $commentdata['comment_author'])) {   $errors[] = 'Author name may only contain letters and spaces.';   }   if (isset($commentdata['comment_content'])) {   if ($commentdata['comment_content'] !== strip_tags($commentdata['comment_content'])) {   $errors[] = 'Comments may not contain HTML.';   }   if (preg_match('/b(?:https?|ftp|mailto):S+/i', $commentdata['comment_content'])) {   $errors[] = 'Comments may not contain links.';   }   }   if (!empty($errors)) {   set_transient('comment_errors_' . session_id(), $errors, 60);   $redirect_url = (wp_get_referer() ?: get_permalink($commentdata['comment_post_ID'])) . '#respond';   wp_safe_redirect($redirect_url);   exit;   }   return $commentdata; }); add_action('comment_form_before_fields', function() {   $errors = get_transient('comment_errors_' . session_id());   if (!empty($errors)) {   echo '<div class="comment-errors" style="color: red;">';   foreach ($errors as $error) {   echo '<p>' . esc_html($error) . '</p>';   }   echo '</div>';   delete_transient('comment_errors_' . session_id());   } });