UNIX line endings (\n) and UTF-8 are just common code standards. As far as I can see, they are not even mentioned in the Coding Standards. Most (all?) core PHP files are just plain US-ASCII. Try to follow that path to keep your files as compatible as possible. If you use UTF-8, add a line … Read more
For the first example, a lot of people will use wp_kses_post to handle basic HTML output from wrapper functions. It’s a shortcut for some basic attributes and tags using wp_kses. You could use this function where you specify allowed tags and attributes that can pass through for the second example.
This is a very subjective question — though a very good and interesting one, and I’ll try to provide my personal view on this. In general, you should always try to adhere to the WordPress Coding Standards. The only exception to this is when you’re changing existing code. Basically, when you’re editing an existing “product” … Read more
The API handles the nonce for the form part because you’re using the settings_fields call, which outputs the *-options nonce, and you’re passing the data to the options.php file for saving, which checks that nonce for you before saving the settings. This part the Settings API does indeed do for you. However, your tab code … Read more
There is no difference when you are using just echo. What works different is unset(): function test_unset_1() { global $post; unset( $post ); } function test_unset_2() { unset( $GLOBALS[‘post’] ); } test_unset_1(); echo $GLOBALS[‘post’]->ID; // will work test_unset_2(); echo $GLOBALS[‘post’]->ID; // will fail The reason is that unset() destroys just the local reference in the … Read more
Using $wpdb->insert and or related methods to modify data within any of the default WordPress tables, be it posts, postmeta, user, usermeta etc is discouraged because there are functions which already exist for the purpose of modififying data within those tables. For example, wp_insert_post wp_update_post wp_delete_post Database Queries Avoid touching the database directly. If there … Read more
Note that the WPCS standards for PHPCS are not “official”. I am one of the maintainers, and all that we can do is to do our best to match the standards that WordPress suggests. In this case, I’m unsure how you would escape the output from wp_oembed_get(). The function may indeed need to be escaped … Read more
These arguments contain arbitrary HTML and cannot be properly escaped. This is essentially a limitation on how Widgets code was designed and you can see in core Widget classes that no escaping is done on these. Lessons to learn: WP core doesn’t consistently adhere to its own coding standards (and getting there isn’t considered worth … Read more
You don’t document function calls, but function definitions. Because the function could be called unlimited times, right? So it makes no sense to document functions when they are called. If you document the call, then probably because you do some things you want to remember later – or let other following developers know. But normally, … Read more
This coding style is known as a Yoda Condition, and it’s nothing specific to WordPress. I’ve used the same style in C++, C#, and even JavaScript code. The main benefit of a Yoda Condition is that it prevents accidental value assignment from a typo. Consider the following (often-seen-in-the-wild) typo: if ( $some_variable = 1 ) … Read more