anatomy of a wordpress plugin
Post on 08-May-2015
904 Views
Preview:
DESCRIPTION
TRANSCRIPT
Anatomy of a WordPress plugin
The Whats, Hows & Why nots
by:
Amit Guptahttp://amitgupta.in/@amitgupta
Amit Gupta@amitgupta
http://igeek.info/
https://github.com/coolamit
http://amitgupta.in/
WordPress is a Content Management System, aka, a CMS.
It is a flexible and extendable publishing platform which allows you get a website up and about easily.
It takes 5 minutes (or less) to installhttp://codex.wordpress.org/Installing_WordPress#Famous_5-Minute_Install
It has a vast API to make it do what you want (even if it doesn’t want to)
You control the content, it doesn’t control you
WordPress has a very well documented plugin API - http://codex.wordpress.org/Plugin_API
Hooks – entry points that lead inside WordPress & make it do what you want
Actions – Waypoints that are executed at specific times or events Filters – Hooks that allow you to manipulate data
Plugin Initialization
register_activation_hook( __FILE__, function(){//dance away to glory, WordPress calls moi
} );
?Limits the playing field for the plugin:
No bundling with themes No use on a controlled platform like WordPress.com VIP, WP-Engine etc.
ACTDon’t react!
Detect the first run of the plugin and initialize
Handle new installation & upgrade routines when plugin is loaded
Use ‘init’ hook if your plugin doesn’t need to initialize earlier
Credits:Clipart image sourced from FreeDigitalPhotos.net
In WordPress Admin
Create settings page(s) for your plugin Hook into the navigation menu & add your navigation items
You can :
Don't create a high level menu if not absolutely necessary.
Create a submenu in Settings or where appropriate
In WordPress Admin Use Settings API as much as possible. It'll keep your UI & UX consistent with WordPress. http://codex.wordpress.org/Settings_API
But if your UI is complex, don't hesitate to think outside the box.
Data Never trust user input, even of a logged in user or administrator.
Always validate and sanitize data. http://codex.wordpress.org/Data_Validation
When sending data to browser, esc_*() functions are your best friends, use themeg. esc_url(), esc_attr()
Security Avoid using SQL directly in WordPress, use the API & vast trove of functions instead
If you must then use wpdb::prepare() to construct your SQL http://codex.wordpress.org/Class_Reference/wpdb
Use nonces to avoid CSRF – http://codex.wordpress.org/WordPress_Nonces
Performance Avoid running SQL directly on database
Use WordPress API for data fetching, WordPress might have it already cached
If you generate data, then cache it
Caches with variable life are slightly complex but give best performance
End of the day, its just PHP code, so optimize it for performance
Resources http://codex.wordpress.org/
http://codex.wordpress.org/Plugin_API
http://codex.wordpress.org/Writing_a_Plugin
http://codex.wordpress.org/Settings_API
http://codex.wordpress.org/Data_Validation
http://codex.wordpress.org/Class_Reference/wpdb
http://codex.wordpress.org/WordPress_Nonces
Questions
Credits:Clipart image sourced from FreeDigitalPhotos.net
top related