If you want to add an settings page, (or add options to and existing settings page) please use the settings api:
1. Register your settings and add a section:
add_action('admin_init', 'plugin_admin_init');
function plugin_admin_init(){
register_setting( 'wpse51578_options_group', 'my_option_field_name', 'wpse51578_validation_callback' );
add_settings_section('wpse51578_main_id', 'My Main Settings', 'wpse51578_main_settings_cb', 'wpse51578_option_page');
}
The 'my_option_field_name' int the register_settings is the name that the fields for your options should have: e.g.
<input type="text" name="my_option_field name[A]"><br />
<input type="text" name="my_option_field name[B]"><br />
The add_settings_section registers a settings section for your page. You can of course, have multiple sections on a page.
2. Output the form elements
The wpse51578_main_settings_cb callback function in add_settings_section is responsible for creating the output of that section. You can output the form elements in it (or user the api further with add_settings_field). No form tags should be used in this bit for this bit. For example:
<?php
function wpse51578_main_settings_cb(){
$my_options = get_option('wpse51578_options_group',array());
$A = ( isset($my_options['A']) ? esc_html($my_options['A']) : 'default-for-a';
$B = ( isset($my_options['B']) ? esc_html($my_options['B']) : 'default-for-b';
?>
Location A <input type="text" value="<?php echo $A; ?>" name="my_option_field name[A]"><br />
Location B <input type="text" value="<?php echo $B; ?>" name="my_option_field name[B]"><br />
<?php
}
?>
3. Output your settings page
When you added you added your page, you defined a callback to output the page contents. This is what that function should do, (using the plugin_options_page if you’ve given it in the question:
<?php
function plugin_options_page() {
?>
<h2>My custom plugin</h2>
Options relating to the Custom Plugin.
<form action="options.php" method="post">
<?php settings_fields('wpse51578_options_group'); ?>
<?php do_settings_sections('wpse51578_option_page'); ?>
<input name="Submit" type="submit" value="<?php esc_attr_e('Save Changes'); ?>" />
</form>
<?php
}?>
4. Validation
Now WordPress performs the nonce checks on your page, and handles (almost) all the processing of the forms. However – it needs you to do one thing – validate. When you register settings, you specify a validation callback function: wpse51578_validation_callback in this example.
This function gets passed an array of the values received from the form fields where the input name was my_option_field_name (as set also when you registered the settings). So for instance, you might expect the array:
array(
'A' => 'some-input', //value for A
'B' => 'some-input-for b', //value for B
);
Its job is to check that array contains ‘correct’ values (what that means depends on context: e.g. if its an e-mail field, is the value actually an e-mail address?). No sanitation is required here (but would be where-ever you output the data).
function wpse51578_validation_callback( $dirty ){
//$dirty is what you receive from the form
$clean = array();
//Sanitize data and pass it to the $clean array
return $clean;
}
Other Resources:
The best tutorial on using the settings API is probably: http://ottodestruct.com/blog/2009/wordpress-settings-api-tutorial/
Please note that I’ve not tested the above, but it is correct in procedure, there just maybe typos or minor errors.