What is the recommended way to create plugin administration forms?

Question

I have seen and been using the following technique for adding php scripts to my plugin for handling custom forms in a wordpress plugin.

from the quizzin plugin:

$code_pages = array('quiz_form.php','quiz_action.php', 'question_form.php', 'question.php');
        foreach($code_pages as $code_page) {
            $hookname = get_plugin_page_hookname("quizzin/$code_page", '' );
            $_registered_pages[$hookname] = true;

For example, the 'quiz_action.php' is later used as the target for an administration form (these forms are used only in wp-admin)

  <form name="post" action="<?php echo $GLOBALS['my_plugin_folder'] ?>/quiz_action.php" method="post" id="post">

UPDATE: This method is discussed here - Admin config screen without menu

The final comment below by a Wordpress core dev seems to discourage this:

http://wordpress.org/support/topic/how-can-i-execute-php-scripts-in-my-plugin-folder

So what is best practice here? Should administration forms be posting to wp-admin/admin.php?action=foo or wp-admin/edit.php?action=bar. How does one register these actions? Is this documented anywhere? To be clear, these files should not be linked from an admin menu.

I'm using Wordpress 3.0.4

Thanks!

Answer 1

I personally just add a menu link and in the function for it handle the form. With $_SERVER['REQUEST_URI'] as the action. Example below.

add_action("admin_menu", "menu" );
function menu(){
    add_menu_page('Test form', 'Test form', 'manage_options', 'show_form' );
}
function show_form(){
    if ( $_SERVER["REQUEST_METHOD"] == "POST" ){
            print "do stuff";
    } else {
         ?><form method="post" action="<?php echo $_SERVER['REQUEST_URI']; ?>"><input type="submit" /></form><?php
        }
}

Answer 2

Basically, it seems there are two ways to do this:

1) The $_registered_pages way detailed in the original question. This seems a bit non-standard and might confuse someone looking at your code.

2) Post your form to an admin url like admin_url('admin.php?page=show_form') where show_form is a registered menu item/function. Inside show_form(), you can switch on whether or not a form has been submitted. If it has you can include another php file conditionally i.e:

function show_form()
{
if ( $_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST['submit'])) {

    require_once('name_of_your_processing_script.php');

} else {
    //do something else. 
}
}

Or just include the file and do any processing / switching in there (probably cleaner).

If you try and just use a file you have created as the form's post action you will get an error. As mentioned in the comments above above you should prevent your files from being called directly and protect and guard against CSRF attacks using nonces.

Apologies for the long comment thread. Would be grateful if people could confirm this is what they meant.