Building forms
This folder is for website creators, administrators and project managers who build forms on a public-sector site: contact forms, reports of problems, feedback, consultation responses, polls and simple requests. Exponential builds forms with the information collector: attributes of a content class that visitors fill in, stored as collections and optionally mailed. The guides cover the mechanism, how to make forms accessible and safe, and how to handle what is collected for as long as you keep it, and no longer.
Contents
The pages
| Page | The answer in one line |
|---|---|
| Information collector basics | Collector attributes, the form template, form types in collect.ini, where submissions go |
| Accessible forms | Labels, instructions, errors, required fields and keyboard use for public forms |
| Spam protection and third parties | Form tokens, reCAPTCHA or hCaptcha and what using a third party means, and alternatives |
| CSRF form tokens | How ezformtoken protects every POST, the "form expired" page, the secret to set |
| File attachments in forms | The Enhanced File datatype for uploads, its limits and the risks of accepting files |
| Mail to receivers | Who gets a mail for each form, per-form receivers, testing without sending real mail |
| Retention of collected information | Reading, exporting and removing submissions on a schedule, with the audit record |
| Consultations and polls | A consultation class with a response form, and the poll type with one answer per user |
Reading order
- Information collector basics.
- Accessible forms, CSRF form tokens and Spam protection and third parties before any form goes live.
- Mail to receivers and Retention of collected information before you collect anything real.
- File attachments in forms and Consultations and polls when you need them.
Up: Building a public-sector site, the index of all building guides, and Governments: start here, the start of the Governments section.
Before you build a form
Note This page describes features and common practice; it is not legal advice. Check the law that applies to your organization with your legal counsel.
- To do: Is a form the right tool, or does the request belong in a case or transaction system? See Linking to online transactions.
- To do: Which fields are needed for the purpose, and no more?
- To do: Who reads the submissions, and who has
infocollector/read? - To do: How long are submissions kept, and who removes them?
- To do: What does the privacy notice next to the form say?
The general guides: Forms with the information collector, Building a contact form, Reading and exporting form submissions, Collected information.
Related pages
- Building a service catalog
- Privacy standards
- Security hardening
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.