Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

i dont really understand why the check if the nonce function exists before running it ...

if ( function_exists('wp_nonce_field') ) 
     wp_nonce_field('gmp_nonce_check');

i understand its for backwards compatibility ...

Also notice how you are verifying that the wp_nonce_field function exists before trying to call it for backward compatibility

but wont it break anyway if on post back i check

if ( isset($_POST['submit']) ) {
     check_admin_referer('gmp_nonce_check');
share|improve this question
    
jiewmeng, you should change the question to be more specific. I think the ideal name would be "Why do I need to check if wp_nonce_field() exists before using it?" –  jeremyclarke Sep 11 '10 at 20:16
    
thanks, i updated the question –  Jiew Meng Sep 12 '10 at 2:01
add comment

3 Answers 3

up vote 5 down vote accepted

The answer is that you should not check if wp_nonce_field() exists before using it!

The recommendation to perform the check assumes that you want to be compatible with versions of WordPress from before the function existed. If Rarst is right that it was introduced in 2.0.4 then you should NOT be supporting earlier versions, as they are all absolutely insecure and anyone using them needs to upgrade RIGHT NOW.

Usually you should not have to check for existence of functions from inside WP, unlike functions from plugins that might not be activated.

Where did you see that comment you quoted? It should be removed.

share|improve this answer
add comment

If I understand your question right - you ask why there is no need to check if check_admin_referer() defined as well?

As far as I see from docs this function is much older (since WP 1.2.0) than wp_nonce_field() (since WP 2.0.4). So I would assume you are much less likely to encounter version that ancient that it doesn't have check_admin_referer().

share|improve this answer
    
i didn't ask why there is no need to check check_admin_referer. but i guess i get u, since check_admin_referer is older. but what exactly does it do? –  Jiew Meng Sep 11 '10 at 11:24
    
check_admin_referer() checks you came from admin page or if your request has correct nonce (both for security reasons). This ensures that even if you follow forged URL (someone made and sent you in email for example) you don't trigger unwanted action even if you are logged in and have sufficient rights. –  Rarst Sep 11 '10 at 11:54
add comment

You check for the existence of a function to prevent a fatal error and subsequent application halt when your code is executed on a version of WordPress that does not include the function you are attempting to use.

Does this ensure backwards compatibility? Absolutely. More importantly, however, this check prevents your code from causing the entire application to crash when your code is executed:

Error handling should be “graceful” in any system – meaning that the application should know how to detect its own errors and handle them in some appropriate manner with minimal interruption for end users. Read more at http://www.devshed.com/c/a/PHP/PHP-Application-Development-Part-Two/2/#wIxuV7yhLhBTU1UZ.99

Thus, in your code, you could do the following:

if ( function_exists('wp_nonce_field') ) {
 wp_nonce_field('gmp_nonce_check');
} else {
 //do nothing
 exit() ;
}
share|improve this answer
    
Îf a function is not available when you need it, you should fix the inner logic of your code, not hide the problem. –  toscho Dec 4 '12 at 23:09
    
@toscho My answer was not meant to imply that you hide a problem. I was merely suggesting that you not allow the application (i.e. WordPress) to stop functioning. –  Daryl Dec 5 '12 at 4:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.