Quoteform

Quoteform is a form builder for one job: working out a price. A visitor picks a
configuration — three rooms, two bathrooms, express turnaround — and a quote
comes out of it. That is a different problem from a contact form, and Quoteform
is built for it rather than around it.

Conditional logic and multi-step forms are the two features that calculator
plugins usually keep behind a paid upgrade. Here they are simply part of the
plugin.

The builder

• Fields — number, slider, text, email, telephone, textarea, dropdown,
  radio, checkboxes, toggle, date, hidden and static HTML content.
• Steps — split a long form into steps, and order both the steps and the
  fields inside them.
• Calculations — named formulas such as subtotal and total. A
  calculation may refer to another one, and Quoteform works out the order for
  you.
• Rules — conditional logic. Show or hide a field or a whole step, or make a
  field required or optional, based on what has been answered. Conditions use
  equals, does not equal, greater than, greater than or equal, less than, less
  than or equal, contains, does not contain, is empty and is not empty.
• Settings — currency, currency position and the number of decimal places.

Showing a form to visitors

A saved form can be placed on the site in three ways, and all three draw exactly
the same form:

• Shortcode — [quoteform id="12"], where 12 is the id shown in the form
  list. It works in posts, pages and any widget or template that runs
  shortcodes.
• Block — search the block inserter for Quote form, then pick the form
  from the dropdown in the block itself.
• Elementor — the Quote form widget, under General. It appears only when
  Elementor is installed.

On the page, the visitor moves through the steps with Back and Next. The total
updates as they answer, fields and steps appear and disappear as the rules say
they should, and a required field they can see has to be filled in before Next
will move them on. On the last step the total is broken down into the
calculations that make it up.

Submissions and entries

On the last step the visitor submits the form. The server then works out the
price again from the answers alone. The browser never sends a total, so a
visitor cannot change the price that gets stored.

• After a submission — show a message with the total and its breakdown, or
  redirect the visitor to a URL. You choose this per form.
• Spam protection — a hidden honeypot field and a time check signed by the
  server. No CAPTCHA and no external service.
• Entries screen — every submission is stored in your WordPress database
  and listed under Quoteform → Entries. Filter by form, new or read, date
  and total. Open an entry to see each answer and the price breakdown.
• Bulk actions — mark entries as read or unread, or delete them.
• CSV export — export the entries that match the current filters.

What this version does not do

Quoteform does not send email notifications, does not take payments and does
not let a visitor save a form and come back to it later. Entries are only on
the Entries screen and in the CSV export.

Formulas, without writing code

Formulas are written in a small, deliberately limited expression language:

{room_count} * 50 + {bathrooms} * 120

if({urgency} == "express", {subtotal} * 1.3, {subtotal})

round(max({subtotal}, 99), 2)

The available functions are if, min, max, sum, round, ceil, floor,
abs, contains and is_empty. The formula editor checks each formula as you
type: it tells you where a formula is malformed, and when a formula refers to
something the form does not have it says so — and if the name is close to one
that does exist, it asks whether that is what you meant.

Nothing is ever executed

The expression language is not JavaScript and it is not PHP. Formulas are read
by Quoteform’s own parser into a syntax tree and evaluated one node at a time.
PHP’s eval() and JavaScript’s eval() and Function() are not used anywhere
in this plugin. The JavaScript that ships is checked before every release for
every spelling of both — eval(), Function() and new Function() — so the
promise is kept by a machine rather than by memory.

Every form is validated again on the server when it is saved, no matter what the
browser sent. Circular references between calculations are refused at save time
rather than discovered later.

Light on the front end

The front-end script is under 10 KB gzipped and loads no framework: no React,
no jQuery, no web fonts, no CDN. It is enqueued only on pages that actually
contain a form.

Free, and that is the whole plan

No pro version, no add-ons, no license key, no account and no hosted service.
Quoteform sends no data anywhere: it makes no request to any external server,
loads no fonts or scripts from a CDN, and collects no usage statistics.

Privacy

Submitted entries stay in your own WordPress database. Each entry stores the
answers, the calculated total and its breakdown, the date, the visitor’s
browser user agent and, if the visitor was logged in, their user ID. The
visitor’s IP address is stored only if you turn on Store the visitor’s IP
address with each entry in the form settings. It is off by default.

The answers can contain personal data, such as a name or an email address,
when your form asks for it. Mention this in your site’s privacy policy.

Source code

The JavaScript and CSS in build/ are compiled. Their human-readable source
lives in admin-src/ and frontend-src/ of the public repository:

https://github.com/muradNasrullayev/quoteform

To rebuild the assets from source:

1. npm install
2. npm run build

PHP dependencies are installed with composer install --no-dev.