# contact-forms/2.3.5/admin/single-submission.php

Contact Forms by Cimatti, version 2.3.5. 355 lines.

- Page: https://pluginprobe.com/plugins/contact-forms/2.3.5/code/admin/single-submission.php
- Raw: https://pluginprobe.com/plugins/contact-forms/2.3.5/raw/admin/single-submission.php
- Modified: 2026-08-21T08:40:42+00:00

Line numbers below start at 1. Link to a line or a range by appending a fragment to the
page URL, for example `https://pluginprobe.com/plugins/contact-forms/2.3.5/code/admin/single-submission.php#L10-L20`.

```php
<?php
if ( ! defined( 'ABSPATH' ) ) exit;

// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Submission detail page with prepared queries

function accua_forms_add_submission_note($id_sub, $note_text)
{
	global $wpdb;
	$time = time();
	$current_date = gmdate('Y-m-d H:i:s', $time);

	$current_user = wp_get_current_user();
	$current_user_email = $current_user->user_email;

	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- Query is a template string with placeholders, prepared inline below
	$query_add_note = "INSERT INTO {$wpdb->prefix}accua_forms_submissions_notes (afsn_sub_id, afsn_date, afsn_text, afsn_user) VALUES (%d, %s, %s, %s)";

	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- Custom table requires direct query, query is prepared inline
	if ($wpdb->query($wpdb->prepare($query_add_note, $id_sub, $current_date, sanitize_textarea_field($note_text), $current_user_email)) === false) {
		return false;
	}
	return array(
		'date' => $current_date,
		'user' => $current_user->display_name,
	);
}
function accua_forms_count_submission_note($id_sub)
{
	global $wpdb;
	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- Query is a template string with placeholders, prepared inline below
	$query_data_submission_notes = "SELECT DISTINCT COUNT(afsn_sub_id) 
        FROM `{$wpdb->prefix}accua_forms_submissions_notes`
        WHERE `afsn_sub_id` = %d";
	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- Custom table requires direct query, query is prepared inline
	$count_submissions_form = $wpdb->get_var($wpdb->prepare($query_data_submission_notes, $id_sub));
	return $count_submissions_form;
}
function accua_forms_return_submission_note($id_sub)
{
	global $wpdb;
	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- Query is a template string with placeholders, prepared inline below
	$query_data_submission_notes = "SELECT *
        FROM `{$wpdb->prefix}accua_forms_submissions_notes`
        WHERE `afsn_sub_id` = %d
        ORDER BY `afsn_date` DESC";

	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- Custom table requires direct query, query is prepared inline
	$query_submission_notes = $wpdb->get_results($wpdb->prepare($query_data_submission_notes, $id_sub));

	$del_nonce = wp_create_nonce( "submission_{$id_sub}_note_del" );
	foreach ($query_submission_notes as $value) {
		$note_user = get_user_by( 'email', $value->afsn_user );
		$note_user_name = $note_user ? $note_user->display_name : $value->afsn_user;
		echo '<div class="accua-note">
			<div class="accua-note-content">' . esc_html($value->afsn_text) . '</div>
			<p class="accua-note-meta">' . esc_html($value->afsn_date) . '<br>' . esc_html($note_user_name) . '
				<span class="row-actions">
					<button type="button" class="button-link accua-delete-note" data-subid="' . (int) $value->afsn_sub_id . '" data-date="' . esc_attr($value->afsn_date) . '" data-nonce="' . esc_attr($del_nonce) . '">' . esc_html__('Delete', 'contact-forms') . '</button>
				</span>
			</p>
		</div>';
	}
}

function accua_forms_delete_submission_note($sid, $date)
{
	global $wpdb;
	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- Query is a template string with placeholders, prepared inline below
	$query_delete_notes = "DELETE FROM `{$wpdb->prefix}accua_forms_submissions_notes` WHERE `afsn_sub_id` = %d AND `afsn_date` = %s";
	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- Custom table requires direct query, query is prepared inline
	return $wpdb->query($wpdb->prepare($query_delete_notes, $sid, $date)) !== false;
}


function accua_forms_single_submission($head = false)
{
	wp_enqueue_style('accua-forms-admin', plugins_url('assets/css/admin.css', ACCUA_FORMS_FILE), array(), ACCUA_FORMS_CSS_VERSION);
	wp_enqueue_script('accua-forms-set-lead-status', plugins_url('assets/js/admin/set-lead-status.js', ACCUA_FORMS_FILE), array('jquery'), ACCUA_FORMS_JS_VERSION, true);
	wp_enqueue_script('accua-forms-single-submission', plugins_url('assets/js/admin/single-submission.js', ACCUA_FORMS_FILE), array('jquery'), ACCUA_FORMS_JS_VERSION, true);
	wp_localize_script('accua-forms-single-submission', 'accuaSingleSubmission', array(
		'l10n' => array(
			'confirmAnonymize' => __('Are you sure you want to anonymize this submission? Personal data will be replaced with placeholders. This cannot be undone.', 'contact-forms'),
			'anonymizing'      => __('Anonymizing…', 'contact-forms'),
			'anonymize'        => __('Anonymize', 'contact-forms'),
			'errorAnonymize'   => __('Error anonymizing submission. Please try again.', 'contact-forms'),
			'confirmDeleteNote' => __('Are you sure you want to delete this note?', 'contact-forms'),
			'deleteNote'        => __('Delete', 'contact-forms'),
			'errorNote'         => __('Error saving note. Please try again.', 'contact-forms'),
		),
	));
	global $wpdb;
	if (isset($_GET['sid'])) {
		$sid = (int) $_GET['sid'];
	}

	if ($head === true) {
		return;
	}
	if ($sid) {
		// Handle GET-based trash action (WP standard link pattern)
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verified below before processing
		if ( isset( $_GET['action'] ) && $_GET['action'] === 'trash' ) {
			check_admin_referer( 'del_sub_form_' . $sid );
			accua_forms_trash_submission( (int) $sid ); // Use echo-free function so redirect header can be sent
			wp_safe_redirect( admin_url( 'admin.php?page=accua_forms_submissions_list&trashed=1' ) );
			exit;
		}
		// Handle GET-based restore action
		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Nonce verified below before processing
		if ( isset( $_GET['action'] ) && $_GET['action'] === 'restore' ) {
			check_admin_referer( 'restore_sub_form_' . $sid );
			accua_forms_restore_submission( (int) $sid );
			wp_safe_redirect( admin_url( 'admin.php?page=accua_forms_submissions_list&restored=1' ) );
			exit;
		}

		$submission_row = $wpdb->get_row($wpdb->prepare("SELECT `afs_status`, `afs_anonymized` FROM `{$wpdb->prefix}accua_forms_submissions` WHERE `afs_id` = %d", $sid));
		$form_status = $submission_row ? (int) $submission_row->afs_status : null;
		$is_anonymized = $submission_row ? (int) $submission_row->afs_anonymized : 0;
		$is_trashed = ( $form_status === -1 );
		?>
		<div id="accua_forms_submissions_list_page" class="accua_forms_admin_page wrap">
			<h1 class="wp-heading-inline"><?php
				/* translators: %d: submission ID */
				printf( esc_html__( 'Submission #%d', 'contact-forms' ), absint( $sid ) );
			?></h1>
			<?php
			$prev = $wpdb->get_var($wpdb->prepare("SELECT `afs_id` FROM `{$wpdb->prefix}accua_forms_submissions` WHERE `afs_status` >= 0 AND `afs_id` < %d ORDER BY `afs_id` DESC LIMIT 1", $sid));
			$next = $wpdb->get_var($wpdb->prepare("SELECT `afs_id` FROM `{$wpdb->prefix}accua_forms_submissions` WHERE `afs_status` >= 0 AND `afs_id` > %d ORDER BY `afs_id` ASC LIMIT 1", $sid));
			if ($prev !== null) {
				echo '<a class="page-title-action" href="' . esc_url( admin_url( 'admin.php?page=accua_forms_submissions_list&sid=' . absint($prev) ) ) . '">&#8249; ' . esc_html__('Previous', 'contact-forms') . '</a>';
			}
			if ($next !== null) {
				echo '<a class="page-title-action" href="' . esc_url( admin_url( 'admin.php?page=accua_forms_submissions_list&sid=' . absint($next) ) ) . '">' . esc_html__('Next', 'contact-forms') . ' &#8250;</a>';
			}
			?>
			<a class="page-title-action" href="<?php echo esc_url( admin_url( 'admin.php?page=accua_forms_submissions_list' ) ); ?>"><?php esc_html_e('All submissions', 'contact-forms'); ?></a>
			<hr class="wp-header-end">

			<?php if ( $is_anonymized ) { ?>
			<div class="notice notice-warning inline">
				<p><?php esc_html_e('This submission has been anonymized. Personal data has been replaced with placeholders.', 'contact-forms'); ?></p>
			</div>
			<?php } ?>

			<?php
			// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- Query is a template string with placeholders, prepared inline below
			$query_data_submission = "SELECT *
		        FROM `{$wpdb->prefix}accua_forms_submissions`
		        WHERE `afs_id` = %d";

			// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- Query is a template string with placeholders, prepared inline below
			$query_data_submission_value = "SELECT *
		        FROM `{$wpdb->prefix}accua_forms_submissions_values`
		        WHERE `afsv_sub_id` = %d";

			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- Custom table requires direct query, query is prepared inline
			$data_submission = $wpdb->get_row($wpdb->prepare($query_data_submission, $sid));
			// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- Custom table requires direct query, query is prepared inline
			$data_submission_values = $wpdb->get_results($wpdb->prepare($query_data_submission_value, $sid));
			?>

			<?php if ( $data_submission ) { ?>
				<?php
				// Resolve form name
				$forms_data = get_option( 'accua_forms_saved_forms', array() );
				$form_name = isset( $forms_data[ $data_submission->afs_form_id ]['title'] )
					? $forms_data[ $data_submission->afs_form_id ]['title']
					: '#' . $data_submission->afs_form_id;

				// Resolve page title
				$page_title = '';
				if ( (int) $data_submission->afs_post_id > 0 ) {
					$page_title = get_the_title( (int) $data_submission->afs_post_id );
				}
				?>
				<div id="poststuff">
					<div id="post-body" class="metabox-holder columns-2">
						<div id="post-body-content">
							<div class="postbox">
								<div class="postbox-header"><h2><?php esc_html_e('Submitted fields', 'contact-forms'); ?></h2></div>
								<div class="inside">
								<?php
								// Build a field_id => label map from global fields
								$avail_fields = get_option( 'accua_forms_avail_fields', array() );
								$field_labels = array();
								foreach ( $avail_fields as $field ) {
									if ( ! empty( $field['id'] ) && ! empty( $field['name'] ) ) {
										$field_labels[ $field['id'] ] = $field['name'];
									}
								}
								?>
								<table class="widefat fixed striped">
									<?php foreach ($data_submission_values as $value) {
										// Skip internal/structural fields
										if ( str_starts_with( $value->afsv_field_id, '__' ) || str_starts_with( $value->afsv_field_id, '_accua_' ) ) {
											continue;
										}

										$label = $field_labels[ $value->afsv_field_id ] ?? ucwords( str_replace( array( '-', '_' ), ' ', $value->afsv_field_id ) );

										if ($value->afsv_type === 'file') {
											$fieldid = rawurlencode($value->afsv_field_id);
											$filename = rawurlencode($value->afsv_value);
											$url = admin_url('admin-ajax.php') . "?action=accua_forms_download_submitted_file&subid={$value->afsv_sub_id}&field={$fieldid}&file={$filename}&nonce=" . wp_create_nonce('accua_forms_download_nonce') . "&_wpnonce=" . wp_create_nonce('download_file_' . $value->afsv_sub_id . '_' . $fieldid);
											echo '<tr>';
											echo '<td>' . esc_html( $label ) . '</td>';
											echo '<td><a href="' . esc_url( $url ) . '" target="_blank">' . esc_html( $value->afsv_value ) . '</a></td>';
											echo '</tr>';
										} else {
											echo '<tr>';
											echo '<td>' . esc_html( $label ) . '</td>';
											echo '<td class="accua-field-value">' . esc_html( $value->afsv_value ) . '</td>';
											echo '</tr>';
										}
									} ?>
								</table>
								</div>
							</div>

							<div class="postbox">
								<div class="postbox-header"><h2><?php esc_html_e('Details', 'contact-forms'); ?></h2></div>
								<div class="inside">
								<table class="widefat fixed striped">
									<tr>
										<td><?php esc_html_e('Form', 'contact-forms'); ?></td>
										<td><a href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin.php?page=accua_forms_list&fid=' . absint( $data_submission->afs_form_id ) ), 'edit_posts' ) ); ?>"><?php echo esc_html( $form_name ); ?></a></td>
									</tr>
									<?php if ( $data_submission->afs_ip ) { ?>
									<tr>
										<td><?php esc_html_e('IP', 'contact-forms'); ?></td>
										<td><?php echo esc_html( $data_submission->afs_ip ); ?></td>
									</tr>
									<?php } ?>
									<?php if ( $data_submission->afs_lang ) { ?>
									<tr>
										<td><?php esc_html_e('Language', 'contact-forms'); ?></td>
										<td><?php echo esc_html( $data_submission->afs_lang ); ?></td>
									</tr>
									<?php } ?>
									<?php if ( $data_submission->afs_uri ) { ?>
									<tr>
										<td><?php esc_html_e('URI', 'contact-forms'); ?></td>
										<td class="accua-field-value"><a href="<?php echo esc_url( home_url( $data_submission->afs_uri ) ); ?>" target="_blank"><?php echo esc_html( $data_submission->afs_uri ); ?></a></td>
									</tr>
									<?php } ?>
									<?php if ( $data_submission->afs_referrer ) { ?>
									<tr>
										<td><?php esc_html_e('Referrer', 'contact-forms'); ?></td>
										<td class="accua-field-value"><a href="<?php echo esc_url( $data_submission->afs_referrer ); ?>" target="_blank"><?php echo esc_html( $data_submission->afs_referrer ); ?></a></td>
									</tr>
									<?php }
									// Driven by what this submission recorded, never by the fields the
									// form currently has: a submission keeps showing its score after the
									// reCAPTCHA v3 field is removed from the form, and one stored before
									// the field existed shows no row at all rather than an empty value.
									// A score of exactly 0 is falsy but real, hence isset() + is_numeric().
									$submission_stats = $data_submission->afs_stats ? json_decode( $data_submission->afs_stats, true ) : array();
									if ( isset( $submission_stats['recaptcha3_score'] ) && is_numeric( $submission_stats['recaptcha3_score'] ) ) { ?>
									<tr class="accua-recaptcha3-score">
										<td><?php esc_html_e('reCAPTCHA v3 score', 'contact-forms'); ?></td>
										<td><?php echo esc_html( number_format_i18n( (float) $submission_stats['recaptcha3_score'], 2 ) ); ?>
											<small><?php esc_html_e('(0.0 = almost certainly a bot, 1.0 = almost certainly a person)', 'contact-forms'); ?></small></td>
									</tr>
									<?php }
									// Why the submission was classified as spam, when something other
									// than the captcha did it. Read from what this submission recorded,
									// so it keeps saying so after the blocklist entry that caught it is
									// removed from the settings.
									if ( isset( $submission_stats['spam_reason'] ) && 'email_blocklist' === $submission_stats['spam_reason'] ) { ?>
									<tr class="accua-spam-reason">
										<td><?php esc_html_e('Spam check', 'contact-forms'); ?></td>
										<td><?php esc_html_e('Marked as spam automatically: the email address is on the blocklist.', 'contact-forms'); ?>
											<small><?php
												/* translators: %s: name of the plugin settings tab that holds the blocklist */
												printf( esc_html__( 'Contact Forms settings, %s tab.', 'contact-forms' ), esc_html__( 'Other settings', 'contact-forms' ) );
											?></small></td>
									</tr>
									<?php } ?>
								</table>
								</div>
							</div>

						</div><!-- #post-body-content -->

						<div id="postbox-container-1" class="postbox-container">
							<div class="postbox">
								<div class="postbox-header"><h2><?php esc_html_e('Submission', 'contact-forms'); ?></h2></div>
								<div class="inside">
									<?php if ( $data_submission->afs_created && $data_submission->afs_created !== $data_submission->afs_submitted ) { ?>
									<p>
										<strong><?php esc_html_e('Opened', 'contact-forms'); ?></strong><br>
										<?php echo esc_html( wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), strtotime( $data_submission->afs_created ) ) ); ?>
									</p>
									<?php } ?>
									<p>
										<strong><?php esc_html_e('Submitted', 'contact-forms'); ?></strong><br>
										<?php echo esc_html( wp_date( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), strtotime( $data_submission->afs_submitted ) ) ); ?>
									</p>
									<?php if ( $page_title ) { ?>
									<p>
										<strong><?php esc_html_e('Page', 'contact-forms'); ?></strong><br>
										<a href="<?php echo esc_url( get_permalink( (int) $data_submission->afs_post_id ) ); ?>" target="_blank"><?php echo esc_html( $page_title ); ?></a>
									</p>
									<?php } ?>
									<?php if ( ! $is_anonymized ) { ?>
									<p><a href="#" id="accua-forms-anonymize-btn" data-subid="<?php echo absint($sid); ?>" data-nonce="<?php echo esc_attr( wp_create_nonce( "anonymize_sub_{$sid}" ) ); ?>"><?php esc_html_e('Anonymize personal data', 'contact-forms'); ?></a></p>
									<?php } ?>
									<p>
										<?php if ( $is_trashed ) { ?>
											<a href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin.php?page=accua_forms_submissions_list&sid=' . absint($sid) . '&action=restore' ), 'restore_sub_form_' . $sid ) ); ?>"><?php esc_html_e('Restore from Trash', 'contact-forms'); ?></a>
										<?php } else { ?>
											<a class="submitdelete deletion" href="<?php echo esc_url( wp_nonce_url( admin_url( 'admin.php?page=accua_forms_submissions_list&sid=' . absint($sid) . '&action=trash' ), 'del_sub_form_' . $sid ) ); ?>" onclick='return window.confirm("<?php echo esc_js(__('Are you sure you want to trash this submission?', 'contact-forms')); ?>");'><?php esc_html_e('Move to Trash', 'contact-forms'); ?></a>
										<?php } ?>
									</p>
								</div>
							</div>
							<div class="postbox">
								<div class="postbox-header"><h2><?php esc_html_e('Lead status', 'contact-forms'); ?></h2></div>
								<div class="inside">
									<?php
									// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Function returns escaped HTML select element
									echo accua_forms_select_lead_status( $data_submission->afs_id, $data_submission->afs_lead_status );
									?>
								</div>
							</div>
							<div class="postbox">
								<div class="postbox-header"><h2><?php esc_html_e('Notes', 'contact-forms'); ?></h2></div>
								<div class="inside">
									<div id="accua-notes-form">
										<textarea id="note_site_user" rows="2" placeholder="<?php esc_attr_e('Add a note…', 'contact-forms'); ?>"></textarea>
										<button type="button" id="accua-add-note-btn" class="button" data-subid="<?php echo absint($sid); ?>" data-nonce="<?php echo esc_attr( wp_create_nonce( "submission_{$sid}_note_add" ) ); ?>"><?php esc_html_e('Add note', 'contact-forms'); ?></button>
									</div>
									<div id="accua-notes-list">
									<?php
									$conta_note = accua_forms_count_submission_note($sid);
									if ($conta_note > 0) {
										accua_forms_return_submission_note($sid);
									}
									?>
									</div>
								</div>
							</div>
						</div><!-- #postbox-container-1 -->
					</div><!-- #post-body -->
				</div><!-- #poststuff -->

			<?php } ?>
		</div>
<?php
	}
}

// phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching

```