I'm wondering what the preferred method is for dealing with AJAX calls. Should one use the same plugin php file to process the POST or a separate one? Which is cleaner or safer?

up vote 47 down vote accepted

the "safer and cleaner" way would be to use admin-ajax.php that comes with wordpress and wp_ajax hook to call you processing function from your plugin file and use wp-nonce to check the integrity of the call.

for example:

your ajax JQuery call would be

<script type="text/javascript" >
jQuery(document).ready(function($) {

    var data = {
        action: 'ACTION_NAME',
            Whatever: '1234',
            _ajax_nonce: '<?php echo wp_create_nonce( 'my_ajax_nonce' ); ?>'

    };

    // since 2.8 ajaxurl is always defined in the admin header and points to admin-ajax.php
    // If you need it on a public facing page, uncomment the following line:
    // var ajaxurl = '<?php echo admin_url('admin-ajax.php'); ?>';
    jQuery.post(ajaxurl, data, function(response) {
        alert('Got this from the server: ' + response);
    });
});
</script>

the in your plugin file add

//if you want only logged in users to access this function use this hook
add_action('wp_ajax_ACTION_NAME', 'my_AJAX_processing_function');

//if you want none logged in users to access this function use this hook
add_action('wp_ajax_nopriv_ACTION_NAME', 'my_AJAX_processing_function');

*if you want logged in users and guests to access your function by ajax the add both hooks. *ACTION_NAME must match the action value in your ajax POST.

then in your function just make sure the request came from valid source

function my_AJAX_processing_function(){
   check_ajax_referer('my_ajax_nonce');
   //do stuff here
}

Hope this Helps

  • This implementation good only for admin side? What about user side? I want to hide /wp-admin/ and change admin URL, so request to hidden URL will be not good – inferusvv Feb 19 at 15:26

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.