wp-includes contains everything needed to run WordPress via the frontend ( and then some ). It is the territory of WordPress Core, and as the adage goes, never modify core under any circumstances. While wp-content may define plugins and themes, the API itself and the vast majority of the WordPress core sits in that folder. … Read more
I can’t answer every single Q you asked, as reading the Q took enough time so far ;), but I try to give you some insights about my personal experience with developing free, open source plugins. 1. Never do too much. Features are the death of every plugin. Build a basic version first and test … Read more
As an ex-software engineer building large business types who landed in an interactive agency let me give you a few thoughts on testing when developing for WordPress: Your Unit Testing should test the smallest amount of behavior that a class can perform. Each class should be able to be tested independently of WordPress. If you … Read more
No, they should not. If a plugin has vulnerabilities just because someone might see its directory structure it is broken. These bugs should be fixed. Security through obscurity is a bug for itself. It’s up to the site owner to allow or forbid directory browsing. A second issue is performance: WordPress scans all PHP files … Read more
When in doubt, look at the source code. Digging in to get_option(), you’ll see (abbreviated): $value = wp_cache_get( $option, ‘options’ ); if ( false === $value ) { $row = $wpdb->get_row( $wpdb->prepare( “SELECT option_value FROM $wpdb->options WHERE option_name = %s LIMIT 1”, $option ) ); // Has to be get_row instead of get_var because of … Read more
Maybe using the wp_redirect() function in the activation hook. In the following example myplugin_settings is a placeholder. Normally this simply is the $hook_suffix you get back from $hook_suffix = add_menu_page( /* etc. */ ); and similar functions. THIS CODE DOESN’T WORK, READ BELOW register_activation_hook(__FILE__, ‘cyb_activation’); function cyb_activation() { // Don’t forget to exit() … Read more
Send the form action either to your homepage, or to a specific page URL. You can’t have $_POST handling within the template because you need to redirect after your process it, and redirect needs to be fired before any HTML output. // you should choose the appropriate tag here // template_redirect is fired just before … Read more
There are two concepts here: validation – making sure data is valid, i.e. an integer is an integer, a date is a date (in the right format etc). This should be done just before saving the data. sanitisation – making the date safe for its use in the current context (e.g. escaping SQL queries, or … Read more
Your code seems correct, but it will load the script only in admin area beacuse you are enqueuing the script in admin_enqueue_scripts action. To load the script in frontend, use wp_enqueue_scripts action (which is not the same that wp_enqueue_script() function): function Zumper_widget_enqueue_script() { wp_enqueue_script( ‘my_custom_script’, plugin_dir_url( __FILE__ ) . ‘js/jquery.repeatable.js’ ); } add_action(‘wp_enqueue_scripts’, ‘Zumper_widget_enqueue_script’); Also, … Read more
Reference file in current path or deeper nested To reference the current path plugin_dir_path( __FILE__ ).”further/nesting/here.css”; which works in Plugins and Themes. Reference URl/URi in a plugin To point to a plugin or theme file, use plugins_url( “path/to/file”, __FILE__ ); which works only in plugins Reference URl/URi in wp-admin folder Always point them to admin_url( … Read more