Validation

Every submission is checked on the server: with JavaScript, without it, over REST and from PHP. The browser's checks are only a convenience; the form has novalidate, so the server's messages are the ones people see.

#Order

1. The form's signed settings are verified (a changed form is refused).
2. The nonce (rendered forms) and the honeypot.
3. Who may use the form (Security).
4. Only the form's own fields are read; everything else in the request is ignored.
5. Each field is checked by its field type: Required, lengths, min/max, choices, dates, files, references and so on, plus cafe_validate_field.
6. Post fields: the title is required, terms must exist.
7. cafe_dynamic_form_validate: your checks across fields.
8. Only when nothing failed: saving.

All messages are collected, so people see every problem at once.

#Checks across fields

add_filter( 'cafe_dynamic_form_validate', function ( array $errors, array $values, $form, array $post ) {
	if ( 'new-event' !== $form->id ) {
		return $errors;
	}

	// $values holds the valid values, keyed by field NAME.
	if ( ! empty( $values['end_date'] ) && $values['end_date'] < $values['start_date'] ) {
		$errors['end_date'] = 'The end date must be after the start date.'; // Field name or key.
	}

	if ( str_contains( strtolower( $post['title'] ?? '' ), 'casino' ) ) {
		$errors[''] = 'This event cannot be accepted.'; // '' = a message for the whole form.
	}

	return $errors;
}, 10, 4 );

#"All or nothing"

When everything is valid, CAFE saves in one database transaction: the new or updated post, its terms and every CAFE value. If anything fails while saving (WordPress refuses the post, a value cannot be written), the transaction is rolled back and the form shows the error. People never end up with half a submission.

What a transaction can and cannot undo:

• ✅ Rows in WordPress and CAFE tables (posts, terms, post meta, CAFE values), when the tables use InnoDB (the default since MySQL 5.5).
• ❌ Things outside the database: e-mails sent, files written, remote API calls made by other plugins on save_post hooks. Do such work in cafe_dynamic_form_saved, which runs only after everything was committed.
• ❌ Caches are cleared after saving, not rolled back: they are rebuilt on the next read.

#Messages

form_errors holds messages for the whole form; when fields failed it starts with "Please correct the fields marked below."