Making Quote Plugin more efficient

Is there more efficient ways to validate the quotes using the
WordPress api?

1. I think you should set a nonce for the form
2. You also should check if current user has capability to save quote
3. To get properly sanitize values form $_POST look at filter_input and/or filter_input_array

I don’t see performance issues on validation, but a possible performance issue is save all the quotes in one big serialized array in a single option: if you have a lot of quotes, then you have to pull from db a very big serialized string (so fill a big amount of memory), unserialize it (serialization/unserialization on big strings can be slow) and all that just to diplay a little portion (one quote).

A performance improvement can be store quotes separately.

What steps would I take to display the quote via a shortcode?

Add shortcode is very simple (maybe this is the reason some developers over-use it), see add_shortcode doumentation.

If your grammer_dw_quote() would return the quote text instead of echo it, then the single line

add_shortcode( 'dw_quote', 'grammer_dw_quote' ); 

would be enough to add a [dw_quote] shortcode that print a random quote.

What would be the best way to delete selected quotes?

Using your way: save all the quotes together, than is hard to locate a specific quote and delete it… you should set a sort of quote id, e.g. where you have

$list_of_quotes[] = $_POST['adding_quote'];

you should probably have

$list_of_quotes[$a_unique_id] = $_POST['adding_quote'];

In this way would be simple get a specific quote and delete it, i.e. unset from the quotes array and then save it again. What this unique id should be is up to you.

However, now that I’ve answered you question I want give you a suggestion.

If you create a custom post type for quotes you solve pretty all your problems:

• The menu item and the form are both created by WordPress
• The unique id handling is done by WordPress, just like the UI for creating, listing, deleting, trashing, untrashing, scheduling…
• The validation, the sanitization, the capability check and all the other security stuff are done by WordPress
• retrieve a random post (for shortcode or not) or the full list of shortcode can be done using core functions

Writing less code you can have a lot of features that can be a pain to implement by yourself, and probably make no sense.

You can make an idea looking at first part of this answer. There the CPT is for ‘jokes’, you have ‘quotes’, but there is no much difference.