Quick Order Form for PrestaShop (v. 1.6-1.7-8.*)

Quick Order Form adds a "Buy in Click" button to your PrestaShop product pages and lets customers place an order through a short pop-up form instead of going through the full cart and checkout[cite: 20]. The shopper fills only the fields you ask for — name, phone, e-mail, comment — sets the quantity, and submits[cite: 20]. Every lead is stored in a dedicated Back Office list where your team can review, sort and follow up[cite: 20].

Long checkouts are the number-one reason carts are abandoned, and the problem is worst on mobile, where every extra step and field costs conversions[cite: 20]. A one-click order form removes that friction: no account, no multi-page checkout, just the contact details you need to confirm the sale[cite: 20]. For made-to-order products, high-ticket items, or stores that close sales by phone, the quick form is often how customers prefer to order[cite: 20].

You decide which fields appear and which are required, so the form stays as short as your process allows[cite: 20]. Built-in callback ("request a call") mode turns the form into a lead-capture form that collects only Name + Phone — ideal for stores that sell by phone — with a configurable, per-language call-to-action label[cite: 20]. Optional admin e-mail notifications mean no lead waits unanswered, and each submission keeps the product, quantity, page context and timestamp for full sales context[cite: 20].

The module is hardened for production[cite: 20]. A built-in Google reCAPTCHA v2 (opt-in), an invisible honeypot field, a dedicated rate-limit table (per session token + real peer IP, not the spoofable X-Forwarded-For), and a single-success session token block spam and abuse before any database write or e-mail[cite: 20]. Server-side validation runs on every field — required-field enforcement, e-mail/phone format checks and length caps — and product name and price are always derived server-side from the validated product, so client-supplied values are never trusted[cite: 20]. An optional GDPR consent checkbox, enforced server-side, records consent state, time and IP with each lead and can link your privacy-policy CMS page[cite: 20]. Multi-store is supported, and the module is compliant from PrestaShop 1.6 through 8 (and PrestaShop 9 per the 1.3.4 update)[cite: 20].

Supported versions:

PrestaShop 1.6, 1.7 and 8 (ps_versions_compliancy min 1.6, max 8.99.99); PrestaShop 9 support was added in 1.3.4[cite: 20]. Multi-store fully supported[cite: 20].

Responsive Modal Layouts: Serves highly specific layout templates split dynamically between PrestaShop 1.6 layouts and 1.7+ / 8 installations[cite: 20].

Granular Lead Badge Tracking: Orders generated via request-a-call routines accept missing catalog data and are flagged visually with a distinct "Callback" badge inside back-office listings[cite: 20].

Unalterable Legal Security Logs: Enforces server-side rejection if necessary compliance items remain unchecked; archives historical consent_given status alongside user timestamp values[cite: 20].

Isolated Rate-Limit Protection: Implements protection mechanics where hit trackers populate a dedicated layout keyed specifically on session tokens and REMOTE_ADDR entries with TTL cleanups[cite: 20].

Stored XSS Injection Defenses: Sanitizes all incoming customer values dynamically; output properties are HTML-escaped completely within administrative contexts and automated email templates[cite: 20].

1.4.3 (2026-06-12) — Introduced dedicated per-field validation error logs straight into the modal interface; errors display clearly underneath the offending input field instead of appending as a generic statement line at the base; validation rules are unchanged[cite: 20].

1.4.2 (2026-06-05) — Integrated an autonomous callback tracking mode (Name + Phone constraints only with per-language CTA options) and introduced a server-enforced GDPR checkbox engine tied to unalterable logs; both components default to OFF[cite: 20].

1.4.1 (2026-06-05) — Discovered and fixed a critical DoS vulnerability regarding row-bloat vulnerabilities affecting Configuration tables inside the 1.4.0 rate-limiting engine: state logs are moved to isolated structural database tables mapped to session tokens and true peer IPs alongside TTL cleanups; rate hit increments occur only after validation arrays pass[cite: 20].

1.4.0 (2026-06-05) — Security and core performance overhaul: added granular per-IP/per-session rate restrictions, hidden honeypot validation fields, single-use security tokens, and optional reCAPTCHA v2 capabilities; product variables are derived server-side; escaped mail outputs; full server-side evaluation checks; patched a PHP 8 fatal error occurring when sorting Back Office logs by Total[cite: 20].

1.3.4 (2025-08-27) — Completed baseline architecture updates and verified structural stability for deployments targeting PrestaShop 9 core setups[cite: 20].