Slide 1

Slide 1 text

Developer Workshop:
 
 What I Wish I’d Known When I Started Erick Hitter @ethitter https://ethitter.com/

Slide 2

Slide 2 text

PREAMBLE Please, interrupt
 and ask questions

Slide 3

Slide 3 text

INTRO Why should
 developers care?

Slide 4

Slide 4 text

Why does this matter? • Helps future-proof your code • Makes your code easier to maintain • Easier for others to learn and maintain your code • Reduces duplication

Slide 5

Slide 5 text

Why does this matter? • Security • Performance • Scalability

Slide 6

Slide 6 text

FIRST Can’t check if the user’s logged in until init

Slide 7

Slide 7 text

Why? • WordPress checks the user login between the after_setup_theme and init actions

Slide 8

Slide 8 text

So? • WordPress may protect you, and it may work earlier, but it can’t be relied on • Can’t load code at the plugins_loaded action based on the user • Theme setup can’t take user into account

Slide 9

Slide 9 text

SECOND Query results aren’t available until wp

Slide 10

Slide 10 text

Practical implications • Most conditionals aren’t available before wp • Can’t use query conditionals at init or in any earlier hooks • Can conditionally load code in the admin, or not, but that’s about it

Slide 11

Slide 11 text

THIRD Never build a manual link again

Slide 12

Slide 12 text

Link Functions •get_permalink() •get_page_by_path( 'about' ) •get_post_type_archive_link( 'waffles' ) •user_trailingslashit() •get_year_link() •get_adjacent_post()

Slide 13

Slide 13 text

Link Functions •add_query_arg() •remove_query_arg()

Slide 14

Slide 14 text

Link Functions •set_url_scheme()
 
 
 
 Force HTTP URLs to HTTPS, vice versa, and more

Slide 15

Slide 15 text

Link Functions •home_url( '/' )
 
 
 
 Many more in
 wp-includes/link-template.php.

Slide 16

Slide 16 text

The importance of slashes • WP’s permalink structure controls if URLs should end in a slash or not. • WP redirects requests to the “incorrect” form of the permalink. • Therefore, use user_trailingslashit() to avoid unnecessary redirects.

Slide 17

Slide 17 text

FOURTH Escaping and Sanitization

Slide 18

Slide 18 text

Why? • Security!!! User input is untrustworthy. • WordPress makes this really easy • Escaping functions for handling output • Sanitization functions for cleaning data to save

Slide 19

Slide 19 text

Escaping Functions •esc_attr() •esc_html() •esc_url() •esc_textarea()

Slide 20

Slide 20 text

Sanitization Functions •sanitize_text_field() •sanitize_email() •sanitize_user()

Slide 21

Slide 21 text

An Exception • Normally, almost all output should be escaped • WordPress template tags are a rare exception • Otherwise, always assume nefarious intent, even by “trusted” users such as administrators

Slide 22

Slide 22 text

An Exception • There’s really no excuse for not sanitizing user input

Slide 23

Slide 23 text

http://xkcd.com/327/

Slide 24

Slide 24 text

FIFTH Nonces

Slide 25

Slide 25 text

Remember how we
 don’t trust the user? • Intent is just as important as input sanitization • Should the user have been able to do that thing, in the way they did so?

Slide 26

Slide 26 text

Examples • Did the user really click the “delete” button? • Did this request originate from where we expected?

Slide 27

Slide 27 text

nonce Functions •wp_create_nonce() •wp_verify_nonce() •wp_nonce_field()

Slide 28

Slide 28 text

Caveats • User ID is part of their creation, so can’t be used for logged-out requests • Actually valid for a time period, not number of uses • Regardless, they play an important part in protecting against CSRF

Slide 29

Slide 29 text

SIXTH Ajax is easy with WordPress

Slide 30

Slide 30 text

Ajax • Hook your function to one of two variable actions • Use the same action name with the request to admin-ajax.php •check_ajax_referer() or use a nonce

Slide 31

Slide 31 text

Ajax •wp_ajax_{$your_action} •wp_ajax_nopriv_{$your_action} • Hook to both if logged-in state isn’t relevant.

Slide 32

Slide 32 text

SEVENTH REST API
 Framework

Slide 33

Slide 33 text

Why? • Framework introduced in WordPress 4.4 • Doesn’t run in admin context, unlike admin-ajax • Much simpler than creating custom REST endpoints • Obeys Core’s permalinks, making requests cacheable

Slide 34

Slide 34 text

How? •register_rest_route( $namespace, $route, $args )

Slide 35

Slide 35 text

EIGHTH Database Interactions

Slide 36

Slide 36 text

Database Interactions • Use custom post types and custom taxonomies instead. • If you must, always $wpdb->prepare() your queries.

Slide 37

Slide 37 text

Database Interactions •$wpdb->get_var() •$wpdb->get_col() •$wpdb->get_row() •$wpdb->insert( $table, $data, $format ) •$wpdb->update( $table, $data, $where, $format, $where_format ) •$wpdb->query()

Slide 38

Slide 38 text

NINTH Enqueue All The Things

Slide 39

Slide 39 text

Register, then enqueue! •wp_register_style() •wp_register_script()

Slide 40

Slide 40 text

Enqueue! •wp_enqueue_style() •wp_enqueue_script()

Slide 41

Slide 41 text

But why? • Reusable • Dependencies • Versioning • Minification • Concatenation • CDN

Slide 42

Slide 42 text

TENTH Cache All The Things

Slide 43

Slide 43 text

Caching • Transients • Object Cache

Slide 44

Slide 44 text

ELEVENTH Remote Requests

Slide 45

Slide 45 text

WP HTTP API •wp_remote_get() •wp_remote_post() •wp_remote_head() •wp_remote_request() •wp_remote_retrieve_response_code()

Slide 46

Slide 46 text

TWELFTH Roles & Capabilities

Slide 47

Slide 47 text

Roles • Don’t check a user’s role, rather check if that user has a specific capability • Roles can change at runtime • Native capabilities can be taken away from roles • Specific user’s capabilities can be filtered • Familiar with user levels? Ignore them too.

Slide 48

Slide 48 text

Capabilities • Add to specific user roles whose members need those abilities • Control access by checking a user’s capabilities • Can add same capability to multiple roles • Can also remove a capability from all roles, blocking all access

Slide 49

Slide 49 text

Capabilities • Don’t add custom capabilities unless they’re necessary • Often, a native capability that WordPress uses for related functionality can be leveraged instead

Slide 50

Slide 50 text

Functions • current_user_can() • user_can() • add_role() • WP_Role::add_cap()

Slide 51

Slide 51 text

THIRTEENTH Rewrites

Slide 52

Slide 52 text

Rewrite Rules • aka “Pretty Permalinks” • They don’t use query strings, improving cacheability • Simplifies routing and parsing a user request • Provides access to request variables through WP_Query and other Core APIs

Slide 53

Slide 53 text

Rewrite Rules • Consider replacing custom rewrite rules with REST API endpoints, when feasible

Slide 54

Slide 54 text

FOURTEENTH Miscellany

Slide 55

Slide 55 text

Miscellany •get_queried_object() •get_queried_object_id() •validate_file()

Slide 56

Slide 56 text

Miscellany •wp_parse_args() •wp_list_pluck()

Slide 57

Slide 57 text

Thanks Erick Hitter @ethitter https://ethitter.com/ https://ethitter.com/p/9425/