I write this PHP code in my functions.php but I was wondering if this the correct way to do it (best way and security) Is this securely? What about the use of wp_nonce_url in the link? (is $_GET request safer with wp_nonce?)

First, I create a custom link in edit.php of the CPT "reservaties" with admin-ajax to call add_action for doing some stuff

function add_new_reservaties_column($columns) {
    $columns['goedkeuren'] = 'Bevestigen';
    $columns['annuleren'] = 'Annuleren';
    return $columns;
add_filter('manage_reservaties_posts_columns', 'add_new_reservaties_column');

function add_new_reservaties_admin_column_show_value( $column, $post_id ) {
if ('goedkeuren' == $column) {
   printf( '<a class="button" href="'.wp_nonce_url(admin_url( 'admin-ajax.php?action=accepteer_reservatie&post_id='.$post_id ),'reservatie').'">Reservatie bevestigen</a>');

if ('annuleren' == $column){
           printf( '<a class="button" href="'.wp_nonce_url(admin_url( 'admin-ajax.php?action=annuleer_reservatie&post_id='.$post_id ),'reservatie').'">Reservatie annuleren</a>');

add_filter('manage_reservaties_posts_custom_column', 'add_new_reservaties_admin_column_show_value', 10, 2);

do some stuff after clicking on the custom link

add_action( 'wp_ajax_accepteer_reservatie', 'accepteer_reservatie' );
add_action( 'wp_ajax_annuleer_reservatie', 'accepteer_reservatie' );

function accepteer_reservatie() {
    if ( isset ( $_GET['action'] ) && !empty($_GET['action']) && !empty($_GET['post_id'])){
        $post_id = $_GET['post_id'];
        // get ACF field values from post
        $email = get_field( 'e-mail', $post_id );
        $naam = get_field( 'naam', $post_id );
        $datum_reservatie = get_field( 'datum_reservatie', $post_id );
        $uur_reservatie = get_field( 'uur_reservatie', $post_id );
        $telefoon = get_field( 'telefoon', $post_id );
        $aantal_personen = get_field( 'aantal_personen', $post_id );
        $bericht__opmerking = get_field( 'bericht__opmerking', $post_id );
        $lunch_of_diner = get_field( 'lunch_of_diner', $post_id );
        // convert special HTML variables and mapping with ACF field values
        if($_GET['action'] == 'accepteer_reservatie'){
            $tekst_email = get_field('reservatie_goedgekeurd', 'option'); 
            $subject = get_field('reservatie_goedgekeurd_onderwerp', 'option'); 
        if($_GET['action'] == 'annuleer_reservatie'){
            $tekst_email = get_field('reservatie_geannuleerd', 'option'); 
            $subject = get_field('reservatie_geannuleerd_onderwerp', 'option'); 
        $tekst_email = str_replace('[NAAM]', $naam, $tekst_email);
        $tekst_email = str_replace('[DATUM_RESERVATIE]', $datum_reservatie, $tekst_email);
        $tekst_email = str_replace('[UUR_RESERVATIE]', $uur_reservatie, $tekst_email);
        $tekst_email = str_replace('[TELEFOON]', $telefoon, $tekst_email);
        $tekst_email = str_replace('[AANTAL_PERSONEN]', $aantal_personen, $tekst_email);
        $tekst_email = str_replace('[BERICHT]', $bericht__opmerking, $tekst_email);
        $tekst_email = str_replace('[EMAIL]', $email, $tekst_email);
        $tekst_email = str_replace('[LUNCH_DINER]', $lunch_of_diner, $tekst_email);
        // send e-mail to client if accept

            $headers = "From: Bistro De Bolle <info@bistrodebolle.be>";
            $send_mail = wp_mail($email,$subject,$tekst_email,$headers);
        //if mail is send show message
    wp_die(); // this is required to terminate immediately and return a proper response

Thanks for your advice!

  • If you use functions.php you cannot update that theme. Instead, you can install the Sntippets plugin and add your handy scripts/snippets as named scripts. – Lenin Oct 15 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.