I am trying to make video plugin. Want to submit data to move the file in a folder which is in the plugin_name folder. To submit/upload I am trying the 'plugin_dir_path()' function. And it is not working. Just showing in browser that "uploading %". But neither it is moving to the folder nor updating the database. Please help me.

<form action = "<?php plugin_dir_path(__FILE__).'titan_video_plugin.php'; ?>" enctype="multipart/form-data" method = "POST">

Title (will appear as the video name)

<input type = "text" name = "title" value = "" placeholder="The Title" size="60"/>
<h3>Upload Video</h3>
<input type = "hidden" name ="MAX_FILE_SIZE" value = "10000000000000000000000000"/>
<input type = "file" name = "file" />
<input type = "submit" name = "upload" value = "Upload" />
<h3>About the video</h3>    
<textarea type="text" name="description" placeholder="The video is..." rows="4" cols="50"></textarea>    

To move the file, I am using the following way....

    $tmp_name = $_FILES['file']['tmp_name'];
    $tar_file_name = $_FILES['file']['name'];
    $t_upload_dir = plugin_dir_path(__FILE__).'Uploads';

    if(move_uploaded_file($tmp_name, $t_upload_dir."/".$tar_file_name)){

                      echo "Uploading successful";

  • 1
    You should never upload files into the wp-content/plugins folder, that folder shouldn't be writable outside of updates. I strongly recommend you read up on attachments and how they work. Also consider there's a risk that if the plugin is updated, you may loose all your videos. I also see you're using a custom form handler in your plugin titan_video_plugin.php, this is a security risk, and dangerous, if not fragile. All requests should be routed via WP, and there are numerous significant downsides to doing it this way
    – Tom J Nowell
    Apr 7 '16 at 15:43
  • 1
    So, what is the way to do it ? I am new in wordpress plugins development, please advice me how to solve the problem. Apr 7 '16 at 15:46

Part 1: Form Handling

Firstly, lets fix your upload form handling. You should never send the user to a dedicated PHP file for processing, wether it's a form or an upload because:

  • The file then has to bootstrap WordPress to use the WP API, tightly coupling it to your folder structure, and introducing fragility
  • The file will work even if the plugin has been disabled, introducing a security risk
  • It's no longer possible to modify and intercept the form handling code from elsewhere
  • Numerous disadvantages regarding caching systems and performance

WordPress is a CMS, and you should let WordPress handle requests. Your job is to tell it what to do with those requests.

So this is how you handle a form:


<form method="post">
    <?php wp_nonce_field( 'allens_form', 'allens_form_nonce' ); ?>
    <input type="hidden" name="allens_form" value="allens_form">
    ... form fields

In a plugin or theme functions.php:

add_action( 'init', 'allens_form_handler');
function allens_form_handler() {
    if ( empty( $_POST['allens_form'] ) ) {
        return; // this isn't a form submission
    if ( ! wp_verify_nonce( $_POST['allens_form_nonce'], 'allens_form' )  ) {
        return; // invalid or missing nonce! Something dodgy's going on here
    // process form data

Also notice the addition of a nonce. This should greatly increase the security of your form from certain types of attacks. Consider asking a new question on this site for a more comprehensive answer of what nonces are and what they protect against.

It may be tempting to use the same strategy for AJAX and use an AJAX endpoint file, but as I mentioned above, this is a bad idea for similar reasons. Instead, use the WP AJAX api, or register a REST API endpoint.

Part 2: Uploading Videos

All uploads go in the uploads folder. On a lot of systems the folder may be in a different place, and may be the only place in the filesystem that WordPress can write to. Your plugin folder should only contain code and assets, it should not contain user content.

The important missing piece of information here is post types.

All posts in WordPress have a 'type'. Posts are of type 'post', Pages are of type 'page', etc, they're all stored the same way in the database. There are other types of post too, but the one you should be interested in is the attachment post type.

When you upload anything into the media library, it's put in the uploads folder, but WordPress doesn't look in that folder to find uploads. Instead, when an upload is made, it creates a post of type attachment, and those attachment posts are what you see in the admin area.

Attachment post types contain information, such as the name of the attachment, where it can be found in the uploads folder, what type of file it is, the author, and other post meta depending on the type of media. These are what you want to use for your video uploads.

As posts can have parents, you'll find that images uploaded and inserted into a post have this relation. Those images will be attachments, and the attachment posts parent is the post they appear in. This is also how featured images work, posts have a custom field/post meta that holds the ID of an attachment post. Said post is the image attachment for the featured image.

Importantly, there are several functions that you will find incredibly handy in implementing your upload, but the one you will find the most useful is this:

media_handle_upload( $file_id, $post_id, $post_data, $overrides );

This function when given the appropriate arguments will take your uploaded file, move it to the correct location, create an attachment post for you, and fill it with all the necessary metadata.

What you then do with the attachment post is up to you, but you will want to save the ID somewhere useful, and always refer to it by its ID. Never store the URL of an attachment. To get the URL for displaying on the page, use this function:

$url = wp_get_attachment_url( $attachment_id );

Be sure to check that the function worked, $url may be an error object, or a false value.

  • As an aside, the 2 if statements in the form handler can be used in your template. This way you can give a success or an error message when the form is submitted, or show the form again
    – Tom J Nowell
    Apr 7 '16 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.