You should always check if a POST variable (or an item/key in an array like the superglobal $_POST
variable) exists before attempting to use it. And you could use isset()
like so:
if (
// Check if the variable is set.
isset( $_POST['mytheme_meta_box_nonce'] ) &&
// .. before accessing the value.
! wp_verify_nonce( $_POST['mytheme_meta_box_nonce'], basename( __FILE__ ) )
)
And you should know that your mytheme_save_data()
function would be called every time the save_post
hook is fired, regardless the origin of the request (e.g. a different metabox without the mytheme_meta_box_nonce
input), hence you should check if the input was actually submitted.
Additionally, it might be better to use empty()
like so:
if (
// Bail if the nonce is empty.
empty( $_POST['mytheme_meta_box_nonce'] ) ||
// .. or that it has expired.
! wp_verify_nonce( $_POST['mytheme_meta_box_nonce'], basename( __FILE__ ) )
)