I'm trying to add a custom meta box to my theme by following the tutorial : https://www.sitepoint.com/adding-meta-boxes-post-types-wordpress/.

I can see the meta box and It gets the value from database (tried by manually updating the post-meta). However, it never gets updated. I tried debugging by var_dump(ing) the $_POST array, it shows that the variable value is empty, but the value is present in $_REQUEST. Does anyone know the reason for this?

The missing variable is called post-excerpt. Here is my code.

function buziness_add_custom_box() {
// Adding layout meta box for page
    esc_html__( 'Excerpt', 'buziness'),

Next is the callback function:

function buziness_post_excerpt($post){
// Add a nonce field so we can check for it later
// Use nonce for verification
wp_nonce_field( basename( __FILE__ ) , 'custom_excerpt_nonce' );

$value = get_post_meta($post->ID, '_excerpt', true );

echo '<textarea style="width:100%" id="post_excerpt" name="post_excerpt">' . esc_attr( $value ) . '</textarea>';
echo "<p>Excerpts are optional hand-crafted summaries of your content that can be used in your theme</p>";


This is the function hooked to save_post hook

add_action('save_post', 'buziness_save_post_excerpt');
* save the custom excerpt metabox data
* @hooked to save_post hook
function buziness_save_post_excerpt($post_id) {
    // Checks save status

    $is_autosave = wp_is_post_autosave( $post_id );

    $is_valid_nonce = ( isset( $_POST[ 'custom_excerpt_nonce' ] ) && wp_verify_nonce( $_POST[ 'custom_excerpt_nonce' ], basename( __FILE__ ) ) ) ? 'true' : 'false';

    // Exits script depending on save status
    if ( $is_autosave || !$is_valid_nonce ) {

    // Check the user's permissions.
    if ( isset( $_POST['post_type'] ) && 'post' == $_POST['post_type'] ) {

        if ( ! current_user_can( 'edit_page', $post_id ) ) {

   else {

        if ( ! current_user_can( 'edit_post', $post_id ) ) {

   // Checks for input and sanitizes/saves if needed
   if( isset( $_POST[ 'post_excerpt' ] ) ) {
       update_post_meta( $post_id, '_excerpt', sanitize_text_field( $_POST[ 'post_excerpt' ] ) );

Here is the part of output from var_dump($_POST)

'ping_status' => string 'open' (length=4)
'add_comment_nonce' => string 'c641d598b3' (length=10)
'_ajax_fetch_list_nonce' => string '1e9f1f3f06' (length=10)
'post_name' => string 'online-training' (length=15)
'post_author_override' => string '1' (length=1)
'custom_excerpt_nonce' => string '0cd0a833c4' (length=10)
'post_excerpt' => string '' (length=0)
'post_mime_type' => string '' (length=0)
'ID' => int 96

and the part of output from var_dump($_REQUEST)

'ping_status' => string 'open' (length=4)
'add_comment_nonce' => string 'c641d598b3' (length=10)
'_ajax_fetch_list_nonce' => string '1e9f1f3f06' (length=10)
'post_name' => string 'online-training' (length=15)
'post_author_override' => string '1' (length=1)
'custom_excerpt_nonce' => string '0cd0a833c4' (length=10)
'post_excerpt' => string 'TES t ' (length=6)

As you can see, the value of 'post_excerpt' is empty in the output of $_POST.

  • as an associative array by default $_REQUEST contains the contents of $_GET, $_POST and $_COOKIE not sure why this is not happening here Oct 12, 2017 at 6:28
  • 1
    can you try changing post_excerpt to something new link my_post_excerpt Oct 12, 2017 at 6:29
  • yup that was it! it seems wordpress uses post-excerpt as defined name
    – Digvijayad
    Oct 12, 2017 at 6:35

1 Answer 1


Using $_REQUEST is a bad practice. Between post requests, get requests, and cookies you can not be certain that you are processing actual user input and not some garbage left in the URL or in the browser's memory.

Meta boxes are "posted" so use only $_POST when processing them.

The other aspect of your code is that you are trying to access things which are not belonging to "your code". Always prefer to use whatever API there is for that instead of trying to access them from global places. While I do not see any reason why would anyone do it, someone at some point will probably have a great idea of removing some values from $_POST because of some imaginary (or less imaginary) reason. In addition APIs like save handlers will be called to handle "saves" which were not originated from a browser at all, at which case those global variables might be empty or contain garbage.

Ohhhhhhhhhhhhh you are using names for your fields which are not prefixed in any way. It is a big can of worms by itself. Always prefix everything which is in global scope.

  • I was just testing using the $_REQUEST to confirm if the variable is really empty.
    – Digvijayad
    Oct 12, 2017 at 6:40
  • yeah, i get that now. hahaha won't make the same mistake again
    – Digvijayad
    Oct 12, 2017 at 6:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.