WordCamp Jerusalem - Doing it Wrong

You’re doing it wrong!
‫עשר טעויות נפוצות בפיתוח לוורדפרס‬

Monday, September 12, 11

You’re doing it wrong!
‫עשר תשע טעויות נפוצות בפיתוח לוורדפרס‬


‫ בחברת‬VIP ‫מפתח‬
Automattic

‫ מפקח בין‬VIP-‫צוות ה‬
WordPress ‫השאר על קוד‬
‫שיוצר מעל‬
‫ל-000,000,000,1 דפים‬
‫נצפים בחודש‬

http://yoavfarhi.com
@yoavf


/me activates WP_DEBUG...

(wsod)

1. WP_DEBUG

WP_DEBUG 1/2
define('WP_DEBUG', true);

• Include notices
• Bypasses some error suppression (ie
WPDB )
• Triggers notices for deprecated functions
ex: PHP Notice: get_links is deprecated since version
2.1! Use get_bookmarks() instead. in /Users/
yoavfarhi/Sites/trunk/wp-includes/functions.php on
line 3409


WP_DEBUG 2/2
Don’t display
define('WP_DEBUG_DISPLAY', false);

Output to wp-content/debug.log
define('WP_DEBUG_LOG', true);


2. Function Naming


Imagine...
Plugin 1 Theme / Plugin 2
function custom_script() { function custom_script() {
//... //...
} }


Imagine...
//... //...
} }

Fatal Error


Imagine...
//... //...
} }

Angry Client


Imagine...
//... //...
} }

Call From Client


Imagine...
//... //...
} }

Time / Money


Imagine...
//... //...
} }

We don’t want that!


Imagine...
//... //...
} }

Solution: Preﬁx


Preﬁx!
function plugin1_custom_script() { function themename_custom_script() {
//... //...
} }


Preﬁx!
function plugin1_custom_script() { function themename_custom_script() {
//... //...
} }

Happy!


Or: Use a Class
class my_plugin {

function custom_script() {
//...
}

function whatever() {
//...
}

}

new my_plugin;


AND {$table_prefix}
erms.term_id =
$table_prefix}
erm_taxonomy.term_taxonomy_
donomy.term_id Queries
3. Direct SQL
AND {$table_prefix}
osts.ID = {$table_prefix}
ostmetata.post_id
AND {$table_prefix}

$last_posts = (array)$wpdb->get_results("
SELECT post_date, ID, post_title, name,
{$table_prefix}terms.term_id
FROM {$table_prefix}posts, {$table_prefix}
term_relationships, {$table_prefix}terms, {$table_prefix}
postmeta, {$table_prefix}term_taxonomy
WHERE {$table_prefix}posts.ID = {$table_prefix}
term_relationships.object_id
AND {$table_prefix}term_taxonomy.term_taxonomy_id =
{$table_prefix}term_relationships.term_taxonomy_id
AND {$table_prefix}terms.term_id = {$table_prefix}
term_taxonomy.term_id
AND {$table_prefix}posts.ID = {$table_prefix}
postmeta.post_id
AND {$table_prefix}postmeta.meta_key = '_mini_post'
AND {$table_prefix}postmeta.meta_value = 0
AND post_status = 'publish'
AND {$table_prefix}terms.term_id != 25
AND {$table_prefix}term_taxonomy.taxonomy =
'category' ");

$last_posts = (array)$wpdb->get_results("
SELECT post_date, ID, post_title, name,
{$table_prefix}terms.term_id
FROM {$table_prefix}posts, {$table_prefix}
term_relationships, {$table_prefix}terms, {$table_prefix}
postmeta, {$table_prefix}term_taxonomy
WHERE {$table_prefix}posts.ID = {$table_prefix}
term_relationships.object_id

NG!
AND {$table_prefix}term_taxonomy.term_taxonomy_id =

O
R
{$table_prefix}term_relationships.term_taxonomy_id

W
AND {$table_prefix}terms.term_id = {$table_prefix}
term_taxonomy.term_id
AND {$table_prefix}posts.ID = {$table_prefix}
postmeta.post_id
AND {$table_prefix}postmeta.meta_key = '_mini_post'
AND {$table_prefix}postmeta.meta_value = 0
AND post_status = 'publish'
AND {$table_prefix}term_taxonomy.taxonomy =
'category' ");

$args = array(
'post_type' => 'post',
'post_status' => 'publish',
'tax_query' => array(
array(
'taxonomy' => 'category',
'terms' => array( '25', '24'),
'field' => 'id',
'operator' => 'NOT IN',
)
),
'meta_query' => array(
array(
'key' => '_mini_post',
'value' => 0,
)
)
);

$last_posts = new WP_Query( $args );


This is so much better because:



• It is easier to read, easier to change



• It is more secure



• It Uses WP object caching and so faster



• It is platform indifferent



• It is future proof



• It is future proof
• It is bound to be improved

4. Loading JS/CSS/etc


Javascript


Javascript
<script type='text/javascript' src='http://thisismysite.com/wp-content/
themes/mytheme/js/newsletter.js'></script>


Javascript

ng!

W ro


Javascript

ng!

W ro

function mytheme_load_script() {
wp_enqueue_script( 'newsletter', 'http://thisismysite.com/wp-content/
themes/mytheme/js/newsletter.js', array( 'jquery' ), '0.1' );
}

add_action( 'wp_enqueue_scripts', 'mytheme_load_script');


Javascript

ng!

W ro

wp_enqueue_script( 'newsletter', 'http://thisismysite.com/wp-content/
themes/mytheme/js/newsletter.js', array( 'jquery' ), '0.1' );
}

at i f ...

but wh
O k,

Javascript

ng!

W ro

wp_enqueue_script( 'newsletter', get_template_directory_uri() .
'/js/newsletter.js', array( 'jquery' ), '0.1' );
}

ht!

Rig


Use wp_enqueue_* because:

• DRY - don’t repeat yourself
• You can set dependencies
• And manage versions
• And easily move to the footer
• And control where it loads (admin/page/...)


Never assume a ﬁle location


• There’s a function for that:


site_url()


site_url()
plugins_url()


site_url()
plugins_url()
content_url()


site_url()
plugins_url()
content_url()
get_theme_directory() *


site_url()
plugins_url()
content_url()
get_theme_directory_uri() *


site_url()
plugins_url()
content_url()
includes_url()


site_url()
plugins_url()
content_url()
includes_url()
admin_url()


5. Fetching remote
content


What’s your transport?

file_get_contents() ?
CURL ?
fsockopen() ?
stream_socket_client() ?


What’s your transport?

!
file_get_contents() ?

W RO NG
CURL ?
fsockopen() ?
stream_socket_client() ?


The WP_Http class
Helper functions

//Simple Get
$resp = wp_remote_get( 'http://example.com/' );

//Simple Post
$args = array(
'body' => 'some data',
'user-agent' => 'your plugin'
);
$resp = wp_remote_post( 'http://example.com', $args );


The WP_Http class
Supports

• Cookies
• Headers
• Authentication
• Timeouts
• Etc...
* Add your own caching

6. Doing Ajax


Doing Ajax


Doing Ajax
front-end: <script>
var ajaxurl = <?php echo plugins_url( 'ajax.php', __FILE__ ); ?>

$('#button').click(function(){
$.post(ajaxurl, function(data) {
$('.result').html(data);
});
});
</script>


Doing Ajax
front-end: <script>

});
});
</script>

ajax.php: <?php
require_once('../../../wp-load.php');
//...


Doing Ajax
front-end: <script>


NG!
});
});

RO
</script>

ajax.php: <?php
W
require_once('../../../wp-load.php');
//...


Doing Ajax
front-end: <script>
var ajaxurl = <?php echo admin_url( 'admin-ajax.php'); ?>

var data = {
action: 'my_action',
};
});
});
</script>


Doing Ajax
front-end: <script>
var ajaxurl = <?php echo admin_url( 'admin-ajax.php'); ?>

var data = {
action: 'my_action',
};
});
});
</script>

php: add_action('wp_ajax_my_action', 'plugin_action_callback');
add_action('wp_ajax_nopriv_my_action', 'plugin_action_callback');

function plugin_action_callback() {
// do whatever
echo $whatever;
die();
}


7. Security? What ‘bout it?

http://xkcd.com/327/


Never trust user input


1. XSS
<h1>Search results for: <?php echo $_GET['s']; ?></h1>
http://mysite.com/?s=</h1><script>alert('This Javascript can do anything!');</script>


1. XSS
Wro ng!


1. XSS
Wro ng!

get_search_query()

Solution:
Escape late, escape EVERYTHING
<h1>Search results for: <?php echo esc_attr( $_GET['s'] ) ; ?></h1>


2.SQL Injection
$wpdb->query(
" UPDATE $wpdb->posts
SET post_title = ". $POST['title'] ."
WHERE ID = 1"
);


2.SQL Injection
$wpdb->query(

ro ng!

W
WHERE ID = 1"
);


2.SQL Injection
$wpdb->query(

ro ng!

W
WHERE ID = 1"
);

Solution:
• Use APIS ( $wpdb->update, $wpdb->prepare )
• Validate data ( whitelist > blacklist )


3.CSRF
Authorization VS Intention


3.CSRF
Authorization VS Intention

Solution:
Use nonces, not just current_user_can()

wp_create_nonce(), wp_verify_nonce(), check_admin_referer()


8. Trunk?

Mac / Linux
$ mkdir blog

$ cd blog

$ svn co http://core.svn.wordpress.org/trunk/ .


Windows / Tortoise SVN


Running on Trunk

No, not for production


9. Not Contributing

Contributing


Contributing

• Core patches/testing/documentation


Contributing

• Release plugins and themes


Contributing

• Translations and i18n


Contributing

• Forums support


Contributing

• Forums support
• Tip! (or Buy)


Questions ?

WordCamp Jerusalem - Doing it Wrong

Recommended

Recommended

More Related Content

Similar to WordCamp Jerusalem - Doing it Wrong

Similar to WordCamp Jerusalem - Doing it Wrong (17)

More from Yoav Farhi

More from Yoav Farhi (14)

Recently uploaded

Recently uploaded (20)

WordCamp Jerusalem - Doing it Wrong