WP Manifestindependent plugin directory
manifest / forms / gf-sqlserver-integration

Gravity Forms SQL Server Data Integration for Bellevue College WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Wordpress plugin to send GravityForms form data to SQL Server

★ 3stars
v2.11latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/bellevuecollege/gf-sqlserver-integration/archive/refs/heads/trunk.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Gravity Forms SQL Server Integration WordPress Plugin

This plugin allows for the moving of data from a submitted Gravity Forms form to SQL Server. Based on the submitted form entry, it fills out the appropriate data model and moves the form data and related transaction data to SQL Server (or, easily, an alternate external database).

The plugin currently hooks to the gform_post_payment_action action. A data model class must exist for each form to which you want to attach SQL Server integration.

Use

Installation of the plugin adds an additional submenu titled BC SQL Server Data Integration to the settings for each individual form in Gravity Forms. On that submenu page, select the data model that maps to your form then save to update the data integration settings.

Add a new data model

  • Create the new data model - create a new class file for your data model and include in the classes directory. Likely one of the existing models could serve as a template.
  • Include in the main plugin file switch - in gf-sqlserver-integration.php require the PHP class file and also add the class to the switch statement that determines which data model to use.
  • Add the new class name to the SQLSERVER_MODELS global variable (comma-delimited list) in the configuration file.

Troubleshooting

If you've installed the plugin and aren't seeing your data in the external DB, try the following:

  • Check the configuration - Check that the database connection info is correct.
  • Check that a data model is selected for the form - On the BC SQL Server Integration submenu page for the form, ensure that a data model is selected.
  • Ensure a payment feed exists for the form(s) - Because this plugin attaches to the post payment action (gform_post_payment_action), a payment feed must exist for each form and be active. As such you need to install the Authorize.Net add-on to Gravity Forms then use the Authorize.Net submenu to create and activate a feed for each form.
  • Check that the form ID for the Gravity Forms form exists in the Forms table in SQL Server - (This is specific to the current BC data constraints and should only be an issue in dev or test environments.) Ensure that the form ID for your form is in the Forms table in SQL Server.

Releases

9 releases.

Tag
Published
v2.11 latest
May 27, 2025 1 year ago
Nov 7, 2023 2 years ago
Aug 21, 2019 7 years ago
Apr 9, 2019 7 years ago
Jul 9, 2018 8 years ago
Jan 25, 2018 8 years ago
Nov 30, 2017 8 years ago
Oct 30, 2017 8 years ago
Jul 27, 2017 9 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Gravity Forms SQL Server Data Integration for Bellevue College 2.11 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
2.11
Findings
2
Worst severity
medium
Content hash
daff1cbdd1996c1d14cc0375…

Findings

  • medium Unserialize of Gravity Forms entry field values

    unsafe_unserialize

    Multiple program model classes call unserialize() on Gravity Forms entry field values (e.g. field 38). Public form submitters can supply crafted serialized objects in those fields. PHP object injection impact depends on available gadgets but is unsafe by design versus maybe_unserialize with allowed_classes or JSON.

    classes/RadiologicTechnologyProgram_AA.php:199-199

    Recommendation

    Replace unserialize with json_decode or maybe_unserialize(..., ["allowed_classes" => false]). Validate structure as arrays only.

  • low Plugin fatal-dies when config.php is missing

    insecure_config

    Main plugin file requires config.php or dies with a message. Sample config expects DATABASE_DSN/USER/PASSWORD. Misconfiguration takes the site down rather than soft-disabling; credentials are expected in web-accessible plugin dir if operators copy sample poorly.

    gf-sqlserver-integration.php:14-14

    Recommendation

    Soft-fail with admin notice; store DB credentials outside the web root or in wp-config constants.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.