I'm developing my first "serious" WordPress plugin using Devin Vinson's plugin boiler plate generated with this generator. Now I need to use a PHP file not present in default boilerplate as action attribute value for a form. When the form is submitted and the PHP file executed I get many fatal errors of call to undefined function for every WordPress function that I call in that file... I already read THIS and I obviously required the PHP file with require_once plugin_dir_path( dirname( __FILE__ ) ) . 'includes/ccwdpo-submit-question.php'; but I didn't solve my problem...

What's my mistake?

  • 2
    Move the logic from the PHP file to the function and invoke it after sending the form. admin_post_{action} hook is what you need. Here you will find usage examples. If something is unclear, ask.
    – nmr
    Apr 13, 2019 at 10:16

1 Answer 1


To be honest, you should never use a PHP file as action attribute for a form in WordPress. WordPress already has API for this and you should use this instead. Why? Because it's always better if your app/site has only one entry point (or as few as possible).

And it's always a bad idea to direct any PHP requests directly to wp-content directory - such requests are very often blocked for security reasons.

So how to do this properly?

Use admin-post instead.

So in your form change this:

<form action="<SOME FILE>" ...

to this:

<form action="<?php echo esc_attr( admin_url( 'admin-post.php' ) ); ?>" ...
    <input type="hidden" name="action" value="myform" />

And later in your plugin, you have to register your actions callbacks:

add_action( 'admin_post_myform', 'prefix_admin_myform_callback' );
add_action( 'admin_post_nopriv_myform', 'prefix_admin_myform_callback' );

function prefix_admin_myform_callback() {
    die("Server received '{$_REQUEST['data']}' from your browser.");
    //request handlers should die() when they complete their task
  • Thank you, I'll try soon your solution but I have a doubt: what means "action"="myform" in hidden input field?
    – user164608
    Apr 13, 2019 at 10:26
  • It tells WP, which action should it run to process this request. The "myform" part is then used to register your callbacks - admin_post_{action} Apr 13, 2019 at 10:28
  • Yeah, I understand but is it correct to use "action" with double quotes as a name for a "not-standard" attribute?
    – user164608
    Apr 13, 2019 at 10:58
  • @icolumbro Aaaa... Sorry for that, it's just a typo - this happens when you write answer on mobile. I've already fixed this - sorry again :) Apr 13, 2019 at 11:00
  • 1
    I figured it is a typo even reading the codex page but I preferred to ask you to be sure, thank you, now I try!
    – user164608
    Apr 13, 2019 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.