i dont really understand why the check if the nonce function exists before running it ...

if ( function_exists('wp_nonce_field') ) 

i understand its for backwards compatibility ...

Also notice how you are verifying that the wp_nonce_field function exists before trying to call it for backward compatibility

but wont it break anyway if on post back i check

if ( isset($_POST['submit']) ) {
  • jiewmeng, you should change the question to be more specific. I think the ideal name would be "Why do I need to check if wp_nonce_field() exists before using it?"
    – jerclarke
    Sep 11, 2010 at 20:16

3 Answers 3


The answer is that you should not check if wp_nonce_field() exists before using it!

The recommendation to perform the check assumes that you want to be compatible with versions of WordPress from before the function existed. If Rarst is right that it was introduced in 2.0.4 then you should NOT be supporting earlier versions, as they are all absolutely insecure and anyone using them needs to upgrade RIGHT NOW.

Usually you should not have to check for existence of functions from inside WP, unlike functions from plugins that might not be activated.

Where did you see that comment you quoted? It should be removed.


If I understand your question right - you ask why there is no need to check if check_admin_referer() defined as well?

As far as I see from docs this function is much older (since WP 1.2.0) than wp_nonce_field() (since WP 2.0.4). So I would assume you are much less likely to encounter version that ancient that it doesn't have check_admin_referer().

  • i didn't ask why there is no need to check check_admin_referer. but i guess i get u, since check_admin_referer is older. but what exactly does it do?
    – Jiew Meng
    Sep 11, 2010 at 11:24
  • check_admin_referer() checks you came from admin page or if your request has correct nonce (both for security reasons). This ensures that even if you follow forged URL (someone made and sent you in email for example) you don't trigger unwanted action even if you are logged in and have sufficient rights.
    – Rarst
    Sep 11, 2010 at 11:54

You check for the existence of a function to prevent a fatal error and subsequent application halt when your code is executed on a version of WordPress that does not include the function you are attempting to use.

Does this ensure backwards compatibility? Absolutely. More importantly, however, this check prevents your code from causing the entire application to crash when your code is executed:

Error handling should be “graceful” in any system – meaning that the application should know how to detect its own errors and handle them in some appropriate manner with minimal interruption for end users. Read more at http://www.devshed.com/c/a/PHP/PHP-Application-Development-Part-Two/2/#wIxuV7yhLhBTU1UZ.99

Thus, in your code, you could do the following:

if ( function_exists('wp_nonce_field') ) {
} else {
 //do nothing
 exit() ;
  • Îf a function is not available when you need it, you should fix the inner logic of your code, not hide the problem.
    – fuxia
    Dec 4, 2012 at 23:09
  • @toscho My answer was not meant to imply that you hide a problem. I was merely suggesting that you not allow the application (i.e. WordPress) to stop functioning.
    – Daryl
    Dec 5, 2012 at 4:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.