Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Asked this question on StackOverflow and they directed me over yonder... nice place ya got here =)

I've been developing a pretty simple WordPress plugin, and wanted to do some live validation of certain fields on the page, which is where I am stuck. I've been looking everywhere for something that worked, and I simply can't make it function.

I've been trying to get the ajax to function properly and I know I'm missing something obvious, I just can't figure it out.

The main function file includes this to register my js file.

function on_screen_validation() {
    wp_enqueue_script( "field_validation", path_join(WP_PLUGIN_URL, basename( dirname( __FILE__ ) )."/field-validation.js"), array( 'jquery' ) );
}
add_action( 'admin_print_scripts', 'on_screen_validation' );

The js runs this code to capture the onblur command and pass the value to the php validation file.

jQuery(document).ready(function() {
    //run field validation on username on blur
    jQuery('.valusername').blur(function() {

        var usernameID = jQuery(this).attr('id');
        var usernameVal = jQuery('#'+usernameID).val();
        var thisFunction = 'validateUserName';

        jQuery.post("mywebaddress...validation.php",{Function: thisFunction, thevars: usernameVal}, function(data) {
             alert(data); //would update validation message here
        });
    });
});

And the validation.php script looks like this:

if(isset($_POST['Function'])){
    call_user_func($_POST['Function'], $_POST['thevars']);
}

function validateUserName($username){   
   if ( username_exists($username) ) {
       echo $username.' does exist'; 
   } else {
       echo $username.' doesnt exist';
   }
}

Obviously I'm just using alerts for now to make sure the data is being checked properly.

If I take out the WordPress username_exists function, and just echo back a string, it works fine. But with username_exists, it creates a 500 internal server error. I need to know how to get this external validation.php file to recongnise WordPress functions (I think), and nothing I've found so far will work.

Thanks for reading... sorry for the long explanation I just wanted to make sure the context was all there so it made sense (I hope!)!

Cheers, Matt

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

PLEASE!! PLEASE!! Don't send the php function names from your javascript. Below is the correct way of doing it. It might not be best way but at least secure way.

To register your javascript (see the use of plugins_url instead of path_join), Also the validation is now part of your plugin, it does not have to go in separate validation.php:

function on_screen_validation() {
    wp_enqueue_script( "field_validation", plugins_url( "field-validation.js", __FILE__ ), array( 'jquery' ) );
    wp_localize_script( "field_validation", "MySecureAjax", array( 'ajaxurl' => admin_url( 'admin-ajax.php' ) ) );
}
add_action( 'admin_print_scripts', 'on_screen_validation' );

add_action( 'wp_ajax_UserNameValidation', 'validateUserName' );

function validateUserName() {
    $username = $_POST['thevars'];
    if ( username_exists($username) ) {
        echo $username.' does exist'; 
    } else {
        echo $username.' doesnt exist';
    }

    // Don't remove exit
    exit;
}

You javascript part:

jQuery(document).ready(function() {
    //run field validation on username on blur
    jQuery('.valusername').blur(function() {

        var usernameVal = jQuery(this).val();
        var action = 'UserNameValidation';

        jQuery.post( MySecureAjax.ajaxurl, {action: action, thevars: usernameVal}, function(data) {
             alert(data); //would update validation message here
        });
    });
});

You can add nonce checking for further security and validation.

share|improve this answer
    
Yikes, glad I came here... didn't realise I was being that insanely dopey. Thanks so much for the response, that fixed everything, thanks so much! –  HappyNuclear Jun 24 '11 at 22:04
add comment

Holy exploit Batman! @Hameedullah makes an excellent answer - to complement it, imagine if I created a form like so;

<form action="your.website/validation.php" method="post">
    <input type="hidden" name="Function" value="eval" />
    <textarea name="thevars">
        file_put_contents(
            $_SERVER['DOCUMENT_ROOT' ] . '/wp-content/uploads/nasty.php',
            '&lt;?php // evil code ?&gt;'
        );
    </textarea>

    <input type="submit" value="Let Battle Commence" />
</form>

If I were to post this to your validation script, I would've just installed a PHP file with my own code on your server! Now all I'd need to do is visit the script in a browser, and all hell can break loose!

share|improve this answer
    
Ah... sorry don't know much about this yet, basically building a plugin to slowly learn my way through it! Thanks very much for the additional info, every bit helps! =) –  HappyNuclear Jun 24 '11 at 22:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.