Tag Info

Hot answers tagged

34

That’s a very good question. It goes down to the dark heart of the plugin API and best programming practices. For the following answer I created a simple plugin to illustrate the problem with easy to read code. <?php # -*- coding: utf-8 -*- /* Plugin Name: Anonymous OOP Action */ if ( ! class_exists( 'Anonymous_Object' ) ) { /** * Add some ...


33

Hi @Geo: As a huge proponent of using WordPress for content management use-cases that surprise the many people who believe WordPress is only a blog, I've had many opportunities to defend it's use which has also allowed me to recognize where it is not useful. Here are the main areas where I've come to believe WordPress is in-fact not the best solution: Non ...


30

Short answer: yes The answer to this question is an unequivocal yes, and to say otherwise is completely irresponsible. Long answer: a real-world example Allow me to provide a very real example, from my very real server, where moving wp-config.php outside the web root specifically prevented its contents from being captured. The bug: Take a look at this ...


21

Bare bone themes are great, personally I prefer them over frameworks. I have noticed that 'liking' one over another comes down to how it feels, so I would suggest trying several out until you find one. For instance a lot people like WordPress boilerplate but I could not get the hang of it. My current favorite is Handcrafted WP, since it very similar to my ...


17

I think Max's is a knowledgeable answer, and that's one side of the story. The WordPress Codex has more advise: Also, make sure that only you (and the web server) can read this file (it generally means a 400 or 440 permission). If you use a server with .htaccess, you can put this in that file (at the very top) to deny access to anyone surfing ...


15

The biggest thing is the wp-config.php contains some sensitive information: your database username/password, etc. So the idea: move it outside the document root, and you don't have to worry about anything. An attacker will never be able to access that file from an external source. Here's the rub, however: wp-config.php never actually prints anything to the ...


14

This is not recommended in any WordPress style guide, and I think it is a bad coding style. Beginners are using this style, maybe because it feels more like HTML … Unfortunately, the default themes are using this style way too often, so some beginners might think it is part of a code style. One disadvantage of this style is comment handling. Look closely ...


14

TL;DR; Enqueue Using external stylesheet PRO: All your styles are in one spot. PRO: Reduces web page coding. PRO: Easier to maintain the plugin. PRO: Can use hooks to alter location of the file. PRO: Can use hooks to unqueue the file. PRO: Can use minify styles automatically. CON: Might add extra HTTP request (can be overcome). Using inline styles ...


14

As a rule of thumb, you should use a POST request for most actions, to make sure they are not executed by accident. But it is also a good practice to redirect to a normal page after a POST request, to prevent duplicate execution when the user refreshes the page. So the flow is like this: Your plugin page with a POST form, which submits to A page that ...


13

The API you offer in a plugin or a theme depends on the logic of that specific code. There is probably no guide that applies to all situations. I am a contributor for multiple plugins with APIs, and what I have learned so far is: Do not offer an API until you really know how people use your code. Release the first two or three versions without any API. ...


13

Definitely YES. When you move wp-config.php outside public directory you protect it from reading using browser when php handler gets maliciously (or accidentally!) changed. Reading your DB login/password is possible when server is hardly infected through a fault of lame administrator. Charge the administrator a fine and get a better-tended and more ...


12

There are two concepts here: validation - making sure data is valid, i.e. an integer is an integer, a date is a date (in the right format etc). This should be done just before saving the data. sanitisation - making the date safe for its use in the current context (e.g. escaping SQL queries, or escaping HTML on output). Validation is, almost universally, ...


10

While I avoid this for PHP comments, I am an avid PHP opener/closer in template files. The alternative involves echoing HTML via PHP strings, which looks even worse in my opinion. As a primitive example: <!-- Example 1 --> <ul> <?php foreach ( $list_items as $list_item ) { echo "<li><a href='" . ...


10

I'll provide a point opposite to what Mike Schinkel laid out. He looked at high-scale or complex situations, I'll mention the opposite. WordPress is a great solution for sites that are non-trivial and/or frequently updated. If the planned site is very small/simple, or frequent updates are not planned, using WordPress may well be overkill. Sites that may ...


10

The best way is without plugin - i set WP3.0 with multisite; the first blog is a dummy to rewrite the uesers to right blog with his language, a small script in the theme to rewirte ro the right language; i see in the browser-language of the users and rewrite; the second is the default blog, the third blog is another blog and so on - olso it is possible to ...


9

Based on my own experience, I've used a combination of method 1 & 2 - the architecture and footer scripts of 1, and the 'look-ahead' technique of 2. For the look-ahead though, I use regex in place of stripos; personal preference, faster, and can check for 'malformed' shortcode; preg_match( '#\[ *shortcode([^\]])*\]#i', $content ); If you're concerned ...


9

This is about choice between seeing page as: as completely PHP-generated entity as HTML document template, powered by PHP template tags Different people tend to think about it differently. Note that functions rarely use this style, because they feel more like block of pure PHP. On other hand it's not uncommon in templates because they are more spread ...


9

In general: Yes, wait for a dedicated hook to start your own code. Never just throw an object instance into the global namespace. But init is rarely necessary. You hook in as late as possible. If your first code runs on wp_head do not use an earlier hook. You can even cascade hooks: add_action( 'wp_head', 'first_callback' ); function first_callback() { ...


8

Actions & Filters The imho best way is to use an action to bring plugin functions into themes. Example #1 Here's a little plugin to test this. <?php /** Plugin Name: (#68117) Print Hello! */ function wpse68117_print_hello() { echo "Hello World!"; } add_action( 'wpse68117_say', 'wpse68117_print_hello' ); Inside the theme: <?php /** ...


8

To make a long story short: get_bloginfo( 'template_directory' ) and get_bloginfo( 'template_url' ) simply return get_template_directory_uri(). So, you can shortcut that second call simply by referring directly to the latter template tag. Refer to source for get_bloginfo(). A few others: 'url' => home_url() 'wpurl' => site_url() 'stylesheet_url' => ...


8

I would also like to add two more. Media content heavy sites. Though WordPress has some great media options they are primarily blog centric in nature, which is to say the management is simple and linear. For media heavy content that serve a lot of photos and video, especially multi-user based, WordPress is not a viable option yet ( example: any one of the ...


8

I for myself use a combination of: one file dedicated to the one-time script using a transient to stop the script from accidentally running more than once using capability-management or user-control to ensure the script is just run by me. Structure I use a file (onetime.php) in my include-folder inc, which is included in the functions.php, and deleted ...


7

You can stop the post from saving all together with minor JQuery hacks and validate the fields before saving on the client side or server side with ajax: first we add our JavaScript to capture the submit/publish event and use it to submit our own ajax function before the actual submit: add_action('wp_print_scripts','my_publish_admin_hook'); function ...


7

There is a very important programming principle: DRY – Don’t repeat yourself. Whenever you realize you are repeating almost the same job try to write an abstraction. For your pad* shortcodes this means: function get_padding( $atts ) { $args = shortcode_atts( array( 'num' => 10 ), $atts ); return str_repeat( ' ', (int) ...


7

Someone asked us to shine in, and I will reply here. Yes, there are security benefits from isolating your wp-config.php from the root directory of your site. 1- If your PHP handler gets broken or modified in some way, your DB information will not be exposed. And yes, I saw this happen a few times on shared hosts during server updates. Yes, the site will be ...


6

I just want to clarify, for the sake of argument, that moving your wp_config.php file does not necessarily mean you have to move it only to the parent directory. Let's say you have a structure like /root/html, where html contains the WP installation and all of your HTML content. Instead of moving wp_config.php to /root, you could move it to something like ...


6

What is a good start point to study? Read a few tutorials on Custom Post Types and Custom Taxonomies. Here´s a good one to get started. What plugins do I need to install? It wouldn´t be too difficult to create the site structure without any plugins. Do I need to install wp-ecommerce plugin? Based on the information provided I don´t think you need that.


6

There is no contradiction, you can use both. Example <!doctype html> <html <?php language_attributes(); ?>> <head> <?php get_header(); ?> </head> <body> <?php get_template_part( 'content', get_post_format() ); ?> <?php get_footer(); ?> </body> </html> The advantage of ...


6

First, as @Toscho implies, the get_header() and get_footer() template tags simply include files named header.php and footer.php, respectively. Both template tags are called from within template files, and you can separate content between template file (index.php) and template part file (header.php, footer.php) any way you want. So, WordPress certainly can ...


6

This function and activation hook prevents the plugin from activating and allows you to check for both a minimum PHP and WordPress version. register_activation_hook( __FILE__, array( 'Your_Plugin_Class_Name', 'activate' ) ); /** * Plugin Activation hook function to check for Minimum PHP and WordPress versions * @param string $wp Minimum version of ...



Only top voted, non community-wiki answers of a minimum length are eligible