1. Best Practices
for Plugin
Development
@nacin
Core Developer, WordPress.org
Tech Ninja, Audrey Capital

2. how not to
write a plugin

3. ur doin
it wrong

4. DEVELOPERS:
Y U NO CODE WELL

5. lsp_add_scripts()
lsp_add_custom_meta()
lsp_create_html()
lsp_save_meta()
install()
One of these things
is not like the others

6. function
nacin_project_func_name()
{}

7. class
Nacin_Project
{
function
__construct()
{}
function
init()
{}
function
activate()
{}
}

8. class
Nacin_Project
{
static
$instance;
function
__construct()
{
self::$instance
=
$this;
}
}
new
Nacin_Project;

9. class
Nacin_Project
{
function
__construct()
{
add_action(
'init',
array(
$this,
'init'
)
);
}
function
init()
{
//
Add
hooks
here
}
}

10. HTTP
Make HTTP requests

11. cURL example
Let’s fetch a URL:
$ch
=
curl_init();
curl_setopt($ch,
CURLOPT_URL,
$url);
curl_setopt($ch,
CURLOPT_RETURNTRANSFER,
true);
curl_setopt($ch,
CURLOPT_HEADER,
false);
Curl_setopt($ch,
CURLOPT_FOLLOWLOCATION,
true);
$result
=
curl_exec($ch);
curl_close($ch);

12. var_dump(
function_exists(
'curl_init'
)
);
bool(false)

13. And what
about:
§ Cookies § HTTP Auth
§ Headers § POST
§ Proxies § Timeouts

14. wp_remote_request
(
$url,
$args
=
array()
);

15. Pick a card, any card
cURL
streams
fopen
fsockopen
HTTP extension

16. 2000 lines of work
already done for you

17. Helpers
We make it so easy.

18. Functions designed
for filters
__return_true();
__return_false();
__return_zero();
__return_empty_array();

19. Serialization
maybe_serialize();
maybe_unserialize();
is_serialized();
is_serialized_string();

20. Server helpers
apache_mod_loaded($module);
got_mod_rewrite();
insert_with_markers();
extract_with_markers();

21. URLs
Bad: get_option('home');
Better: get_bloginfo('url');
Yes:
home_url();

22. URLs
Bad: get_option
Better: ('siteurl');
Yes:
get_bloginfo
('wpurl');
site_url();

23. Bad:
ABSPATH.
'wp-­‐content/plugins/nacin'
Still bad:
WP_CONTENT_DIR
.
'plugins/nacin'
Better:
WP_PLUGIN_DIR
.
'/nacin'
Yes:
dirname(
__FILE__
)

24. Bad:
get_bloginfo('url')
.
'wp-­‐content/plugins/nacin/a.php'
Better:
WP_CONTENT_URL
.
'/plugins/nacin/a.php'
Yes:
plugins_url(
'a.php',
__FILE__
)

25. Default Function Arguments
function
myfunc(
$args
=
array()
)
{
$defaults
=
array(
'first_arg'
=>
true,
'second_arg'
=>
'foo'
);
$args
=
wp_parse_args($args,
$defaults);
Even allows for query string calls:
nacin_my_func(
'first_arg=false'
);

26. Post Types Settings
Taxonomies Capabilities
Widgets Templates
Shortcodes Query
Options i18n/L10n
Transients Admin Menus
Cache Meta Boxes
Cron Multisite
Formatting Updates
HTTP Filesystem
Embeds Admin Bar

27. Other nifty helpers
download_url(
$target
);
unzip_file(
$file,
$to
);
wp_handle_sideload(
$file
);

28. register_activation_hook(
__FILE__,
'my_activation_hook');
Ready your plugin (add_option)
Set and flush rewrite rules
Modify roles/capabilities

29. register_deactivation_hook(
__FILE__,
'my_deactivation_hook');
Restore and flush rewrite rules
Restore roles/capabilities
But don’t remove your options

30. Uninstall hook
Clean
up
after
yourself.

31. uninstall.php
if
(!defined
('WP_UNINSTALL_PLUGIN'))
die();
delete_option('my_plugin_option');
There’s also a hook, like activation and
deactivation, but it has its caveats.

32. But be considerate
of my data.

33. Here’s a secret…
I hate
activation
hooks.

34. Use the right level
of the API.

35. Don’t make any
assumptions. Ever.

36. Friends don’t let friends use
direct database queries.

37. Security.
Please.
Please.
Please.

38. Authentication
vs. Intention
Nonces for CSRF
protection. But check
capabilities too.

39. Plugins can
do anything.

40. Plugins can
do anything.

41. Be considerate of
other plugins.

42. Documentation is nice, but…
Consult
the code.

43. Please…
Read and
follow.
the coding
standards.

44. “
I love the
feeling
I get from my work
being used by
30 million .

45. Benefit from
lessons in
development
and user
experience.
(Consultants, hint hint.)

46. I learned more
in 3 months than
I had learned in
3 years .

47. @nacin
Thanks!