The document outlines 10 things that every WordPress plugin developer should know, including enabling debugging, prefixing functions, enqueuing scripts and styles properly, only including JS/CSS on admin pages, using AJAX in the admin, adding extensibility hooks, supporting multisite, internationalization, security, and using helpful functions and constants. It provides examples and explanations for each topic to help plugin developers write more effective and secure code.

1. 10 Things Every Plugin
Developer Should Know
Dave Donaldson
Co-founder
Max Foundry

2. Overview
• Enable Debugging
• Prefix Your Functions
• Enqueue Scripts and Styles
• Your JS/CSS On Your Admin Pages Only
• AJAX in the Admin
• Extensibility Hooks
• Support Multisite
• Internationalization and Localization
• Security
• Helper Functions and Constants

3. 1. ENABLE DEBUGGING

4. Enable Debugging
• Don’t develop without it
• Don’t develop without it
• Don’t develop without it
• Don’t develop without it
• Don’t develop without it
• Don’t develop without it
• Don’t develop without it

5. Enable Debugging
In wp-config.php, comment out this line:
define(‘WP_DEBUG’, false);
And replace with these:
// Turns WP debugging on
define(‘WP_DEBUG’, true);
// Tells WP to log everything to the /wp-content/debug.log file
define(‘WP_DEBUG_LOG’, true);
// Doesn’t force the PHP ‘display_errors’ variable to be on
define(‘WP_DEBUG_DISPLAY’, false);
// Hides the errors from being displayed on-screen
@ini_set(‘display_errors’, 0);

6. Enable Debugging
• Visibility for WP errors and notices
• Notices are important for deprecated
functions
• Becomes part of your cadence
• Watch debug.log
• Use Debug Bar and Blackbox plugins

7. 2. PREFIX YOUR FUNCTIONS

8. Prefix Your Functions
• All functions get loaded into the same
execution space…
• … which requires each function to be uniquely
named…
• … which means you should prefix your
functions

9. Prefix Your Functions
DO NOT be generic:
// Do you know how many people have
// these *exact* same functions?
function copy_file() {
}
function save_data() {
}

10. Prefix Your Functions
DO this instead:
// Assuming the name of your plugin
// is ‚My Awesome WordPress Plugin‛
function mawp_copy_file() {
}
function mawp_save_data() {
}

11. Prefix Your Functions
Classes are the one caveat:
class MawpCommon {
function copy_file() {
}
function save_data() {
}
}

12. Prefix Your Functions
Classes allow you to do this:
$common = new MawpCommon();
$common->copy_file();
$common->save_data();

13. 3. ENQUEUE SCRIPTS AND
STYLES

14. Enqueue Scripts and Styles
• The WP enqueue functions are the proper way
to include javascript and stylesheets
wp_enqueue_script(‘thickbox’);
wp_enqueue_script(‘path-to-my-script.js’,
array(‘jquery’));
wp_enqueue_style(‘thickbox’);
wp_enqueue_style(‘path-to-my-styles.css’);

15. 4. YOUR JS/CSS ON YOUR
ADMIN PAGES ONLY

16. Your JS/CSS On Your Admin Pages
Only
• Devs adding their javascript and styles to every
admin page, including pages for other plugins, is
a HUGE PITA
• If you are one of these people, I have a bill to
send you
• These are your friends, and in turn, my friend:
– admin_print_scripts-{hookname}
– admin_print_styles-{hookname}

17. Your JS/CSS On Your Admin Pages
Only
add_action(‘admin_menu’, ‘mawp_admin_menu’);
function mawp_admin_menu() {
$admin_pages = array();
$admin_pages[] = add_submenu_page();
$admin_pages[] = add_submenu_page();
foreach ($admin_pages as $admin_page) {
add_action(‚admin_print_scripts-{$admin_page}‛, ‘mawp_admin_scripts’);
add_action(‚admin_print_styles-{$admin_page}‛, ‘mawp_admin_styles’);
}
}
function mawp_admin_scripts() {
wp_enqueue_script();
}
function mawp_admin_styles() {
wp_enqueue_style();
}

18. 5. AJAX IN THE ADMIN

19. AJAX in the Admin
• Very useful for creating an improved user
experience
• Consists of the following:
– A nonce
– A little jQuery
– The wp_ajax hook

20. AJAX in the Admin
A nonce:
<form id=‚mawp_form‛ method=‚post‛>
<?php wp_nonce_field(‚mawp_nonce_action‛, ‚mawp_nonce_name‛) ?>
</form>

21. AJAX in the Admin
A little jQuery:
<script type=‚text/javascript‛>
jQuery(document).ready(function() {
jQuery(‚#some_button‛).click(function() {
var form_data = jQuery(‚#mawp_form‛).serialize();
form_data += ‚&action=mawp_do_stuff‛;
jQuery.ajax({
type: ‚POST‛,
url: ‚<?php echo admin_url(‘admin-ajax.php’) ?>‛,
data: form_data,
success: function(message) {
// Display the message
}
});
});
});
</script>

22. AJAX in the Admin
The wp_ajax hook:
add_action(‘wp_ajax_mawp_do_stuff’, ‘mawp_do_stuff’);
function mawp_do_stuff() {
if (isset($_POST)) {
if (check_admin_referer(‘mawp_nonce_action’, ‘mawp_nonce_name’)) {
// Do some stuff
$message = ‘Han shot first’;
echo $message;
die();
}
}
}

23. 6. EXTENSIBILITY HOOKS

24. Extensibility Hooks
• Allows other devs to extend your plugin
• A plugin with plugins is a mini-ecosystem
• Actions and filters
– Actions: used for executing functions
– Filters: used for manipulating data

25. Extensibility Hooks
• Actions
– do_action()
• Creates hookable location for custom actions
– add_action()
• Attaches a function to a hook created with do_action()
– has_action()
• Checks if an action has been created with do_action()
– remove_action()
• Removes an action that was created with do_action()

26. Extensibility Hooks
• Filters
– apply_filters()
• Creates hookable location for custom filters
– add_filter()
• Attaches a filter to hook created with apply_filters()
– has_filter()
• Checks if a filter has been created with apply_filters()
– remove_filter()
• Removes a filter that was created with apply_filters()

27. Extensibility Hooks
Action example:
function mawp_do_stuff() {
do_action(‘mawp_do_stuff_before’);
// Logic for doing stuff goes here
do_action(‘mawp_do_stuff_after’);
}
add_action(‘mawp_do_stuff_before’, ‘your_before_action’);
function your_before_action() {
// Do stuff at the beginning of mawp_do_stuff
}
add_action(‘mawp_do_stuff_after’, ‘your_after_action’);
function your_after_action() {
// Do stuff at the end of mawp_do_stuff
}

28. Extensibility Hooks
Filter example:
function mawp_html_sample() {
$html = ‘<div>’;
$html .= ‘<p>Han shot first.</p>’;
$html .= ‘</div>’;
return apply_filters(‘mawp_html_filter’, $html);
}
add_filter(‘mawp_html_filter, ‘your_html_filter’);
function your_html_filter($html) {
$output = ‘<div class=‚outer-div‛>’;
$output .= $html;
$output .= ‘</div>’;
return $output;
}

29. Extensibility Hooks
• 2 great examples:
– bbPress
– Shopp

30. 7. SUPPORT MULTISITE

31. Support Multisite
• Important but often overlooked
• Some people won’t use your plugin
• Setup a local multisite install for testing

32. Support Multisite
register_activation_hook(__FILE__, ‘mawp_do_activation’);
register_deactivation_hook(__FILE__, ‘mawp_do_deactivation’);
function mawp_do_activation($network_wide) {
if ($network_wide) {
mawp_call_function_for_each_site(‘mawp_activate’);
}
else {
mawp_activate();
}
}
function mawp_do_deactivation($network_wide) {
if ($network_wide) {
mawp_call_function_for_each_site(‘mawp_deactivate’);
}
else {
mawp_deactivate();
}
}

33. Support Multisite
function mawp_call_function_for_each_site($function) {
global $wpdb;
// Hold this so we can switch back to it
$current_blog = $wpdb->blogid;
// Get all blogs in the network and invoke function for each one
$sql = ‚SELECT blog_id FROM $wpdb->blogs‛;
$blog_ids = $wpdb->get_col($wpdb->prepare($sql));
foreach ($blog_ids as $blog_id) {
switch_to_blog($blog_id);
call_user_func($function);
}
// Now switch back to the root blog
switch_to_blog($current_blog);
}

34. 8. INTERNATIONALIZATION AND
LOCALIZATION

35. Internationalization and
Localization
• i18n: Internationalization
• l10n: Localization
• What’s the difference?
– i18n: Changing software so it’s not hardwired to a
single language/culture/locale
– l10n: Adding resources to the software so that a
particular language/culture/locale is supported

36. Internationalization and
Localization
• Don’t blindly discount non-English speaking
cultures
• Europe is a huge market
• Some people won’t buy if not in their
language
• IT’S TOO EASY NOT TO DO FROM THE
BEGINNING!

37. Internationalization and
Localization
• 4 basic functions:
__(): Makes a string translatable
_e(): Echoes translatable string
_n(): For plural translations
_x(): Provides translation context
• Must type out the text domain, cannot store it
as a variable

38. Internationalization and
Localization
add_action(‘init’, ‘mawp_load_textdomain’);
function mawp_load_textdomain() {
$languages_folder = dirname(plugin_basename(__FILE__));
$languages_folder .= ‘/languages/’;
// 1st param is the text domain and must be unique, so best
// practice is to name it the same as your plugin folder. The
// 2nd param corresponds to a deprecated function, so you can
// always set it to false.
// IMPORTANT: text domain CANNOT include underscores!
load_plugin_textdomain(‘mawp’, false, $languages_folder);
}

39. Internationalization and
Localization
// Using __()
$fact = __(‘Han shot first.’, ‘mawp’);
// Using _e()
_e(‘Han shot first.’, ‘mawp’);
// Using _n()
printf(_n(‘Saved %d item.’, ‘Saved %d items.’, $count, ‘mawp’), $count);
// Using _x()
echo _x(‘Comment’, ‘column name’, ‘mawp’);

40. Internationalization and
Localization
• Create the POT and MO files
• These are the files that translators need
• Generated by various tools
– Poedit

41. 9. SECURITY

42. Security
• Many WordPress vulnerabilities don’t come
from the core
• Data can’t be trusted
• General rule: validate input, escape output
• WP has many functions to help you

43. Security
• For protecting against XSS attacks:
esc_url()
esc_url_raw()
esc_js()
esc_html()
esc_attr()
esc_textarea()

44. Security
• For protecting against SQL injection attacks:
$wpdb->prepare()
$wpdb->insert()
$wpdb->update()
$wpdb->escape()
esc_sql()

45. Security
• For sanitizing data input:
sanitize_email()
sanitize_file_name()
sanitize_user()
sanitize_text_field()
sanitize_html_class()
sanitize_key()
sanitize_option()

46. Security
• You don’t want to be the next TimThumb
• Big topic, lots to know
• Tomorrow: “Secure All The Things!”, Dougal
Campbell

47. 10. HELPER FUNCTIONS AND
CONSTANTS

48. Helper Functions and Constants
• Useful for finding plugin and content folders
• Folder locations in WP can be changed
• Try to avoid hardcoded locations

49. Helper Functions and Constants
• Functions:
plugins_url() plugin_basename()
themes_url() get_template_directory_uri()
get_stylesheet_uri() home_url()
admin_url() site_url()
content_url() includes_url()
wp_upload_dir() network_admin_url()
network_site_url() network_home_url()

50. Helper Functions and Constants
• Constants:
DOING_AUTOSAVE
WP_ADMIN
WP_NETWORK_ADMIN
ABSPATH
WP_PLUGIN_DIR
WP_PLUGIN_URL
WP_CONTENT_DIR
WP_CONTENT_URL
MULTISITE
COOKIE_DOMAIN

51. References
• Debug Bar
– http://wordpress.org/extend/plugins/debug-bar/
• Blackbox Debug Bar
– http://wordpress.org/extend/plugins/blackbox-debug-bar/
• AJAX
– http://codex.wordpress.org/AJAX_in_Plugins
• Actions and Filters
– http://wp.tutsplus.com/tutorials/plugins/writing-extensible-plugins-with-actions-and-filters/
• Internationalization
– http://codex.wordpress.org/I18n_for_WordPress_Developers
• WordPress Constants
– http://wpengineer.com/2382/wordpress-constants-overview/
• Data Validation
– http://codex.wordpress.org/Data_Validation
– http://wp.tutsplus.com/tutorials/creative-coding/data-sanitization-and-validation-with-wordpress/
• WP_Query
– http://codex.wordpress.org/Class_Reference/WP_Query
• dbDelta
– http://codex.wordpress.org/Creating_Tables_with_Plugins

52. Thanks!
Dave Donaldson
dave@maxfoundry.com
@arcware