Use a PHP file as action for a form in a WordPress plugin, what's the correct way?

Question

I'm developing my first "serious" WordPress plugin using Devin Vinson's plugin boiler plate generated with this generator. Now I need to use a PHP file not present in default boilerplate as action attribute value for a form. When the form is submitted and the PHP file executed I get many fatal errors of call to undefined function for every WordPress function that I call in that file... I already read THIS and I obviously required the PHP file with require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/ccwdpo-submit-question.php'; but I didn't solve my problem...

What's my mistake?

Answer 1

To be honest, you should never use a PHP file as action attribute for a form in WordPress. WordPress already has API for this and you should use this instead. Why? Because it's always better if your app/site has only one entry point (or as few as possible).

And it's always a bad idea to direct any PHP requests directly to wp-content directory - such requests are very often blocked for security reasons.

So how to do this properly?

Use admin-post instead.

So in your form change this:

<form action="<SOME FILE>" ...

to this:

<form action="<?php echo esc_attr( admin_url( 'admin-post.php' ) ); ?>" ...
    <input type="hidden" name="action" value="myform" />

And later in your plugin, you have to register your actions callbacks:

add_action( 'admin_post_myform', 'prefix_admin_myform_callback' );
add_action( 'admin_post_nopriv_myform', 'prefix_admin_myform_callback' );


function prefix_admin_myform_callback() {
    status_header(200);
    die("Server received '{$_REQUEST['data']}' from your browser.");
    //request handlers should die() when they complete their task
}