I'm trying to securely save custom data to database from plugin backend via ajax.

JavaScript code that runs after clicking save button:

    url: ajaxVars.ajaxurl,
    type: 'post',
    data: {
        action : 'myPluginDataSave',
        someData: 'blabla',
        myPluginNonce : ajaxVars.nonce
    complete: function(data) {          

PHP code (some parts are missing), ajax_save_data function receives data from JS code:

add_action( 'wp_ajax_myPluginDataSave', array(&$this, 'ajax_save_data') );
wp_enqueue_script( 'my-plugn-js' );
wp_localize_script( 'my-plugn-js', 'ajaxVars', array(
                    'ajaxurl' => admin_url( 'admin-ajax.php' ),
                    'nonce' => wp_create_nonce( 'myPluginNonce' ),                          

function ajax_save_data() {
    if ( !isset($_POST['myPluginNonce']) || !wp_verify_nonce( $_POST['myPluginNonce'], 'myPluginNonce' ) ) 
        die ( 'you cant do this' ); 

    echo 'here data gets saved to DB' . $_POST['someData'];


Hooks are added only in admin (inside is_admin() if statement). Save button can be clicked multiple times (without page refresh).

Code works. But, my question: is this correct way to do this? Do I need nonce there?

Thank you for advice.


I don't see any is_admin conditional statement which is why you should include it in your snippet so we can properly assess what you are attempting to do outside of the obvious question.

Either way a nonce should be mandatory. That function that receives and processes your AJAX request/response should also verify your nonce to ensure the request is a valid and secure request - even IF the request is originating from the back-end, it still could be insecure or an attempt to exploit the system.

Also look at:

  • Thank you for answer, but my question is more about multiple ajax request per one page. For example I have two buttons that send ajax request to admin - "update_calendar" and "get_date". Should I have separate nonce for every single request? Or for each button? – Marvin3 Nov 13 '12 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.