The use case is providing the user with 20 different buttons on a single login protected page, each button is a category from a custom database table and the content is shown in a textarea element on a button onClick event. It is like a random quotes button on a page that refreshes a div without reloading the page. Sort of Hello Dolly plugin with an AJAX button.
I have coded a basic PHP script (main.php) that gets a random row from a MySQL database using an ajax call to a separate PHP page (getData.php). Database credentials are hardcoded in the getData page. This works OK.
Now I want to put this functionality inside a membership access-only page on a WordPress site. However, I'm finding it very difficult to know what is the best practise approach to this. I have read many different approaches to the problem from building my own plugin, putting database credentials and SQL in the functions.php file of my theme (clearly a bad idea), shortcodes, etc. I am very confused.
I want to use the WordPress framework and have next to no knowledge of enqueing and nonce. And not sure how to get (if I can) data from a custom table in the wp_ database.
I think I have broken the problem into these steps/questions:
1: How to access custom database table row content using WordPress framework
3: How to refresh a div/element on a protected page via AJAX
4: Where to put the PHP function that connects 1, 2 and 3
5: How do I ensure a bad actor can't just access these functions directly and hammer my database and steal my content
I'm planning to use the WP Members plugin to restrict access to the page and am using the Understrap theme.
Let me know if I can provide further information. Help is much appreciated.