Plugin security (nonces, sanitization) in Wordpress - Mini Project: Build & Apply

Secure WordPress Plugin with Nonces and Sanitization

📖 Scenario: You are building a simple WordPress plugin that adds a form to the admin dashboard. This form lets the admin enter a message that will be saved as an option. To keep the plugin safe, you need to use WordPress security features like nonces to protect the form from unauthorized submissions and sanitize the input to avoid harmful data.

🎯 Goal: Create a WordPress plugin that shows a form in the admin area. The form must use a nonce field for security and sanitize the input before saving it. This will protect the plugin from attacks and keep the data clean.

📋 What You'll Learn

Create a function to display a form with a nonce field

Add a configuration variable for the option name

Process the form submission using nonce verification and sanitize_text_field

Hook the form display function to the admin menu

💡 Why This Matters

🌍 Real World

WordPress plugins often handle user input and need to protect against attacks like CSRF and XSS. Using nonces and sanitization is essential for plugin security.

💼 Career

Understanding how to secure WordPress plugins is important for developers working with WordPress to prevent vulnerabilities and protect user data.

1

Create the form display function with a nonce field

Create a function called myplugin_display_form that outputs a simple HTML form with a textarea named myplugin_message and includes a nonce field using wp_nonce_field with action myplugin_save_message and name myplugin_nonce.

Wordpress

# Your code here

Need a hint?

Use wp_nonce_field('myplugin_save_message', 'myplugin_nonce') inside the form to add the nonce.

2

Add a configuration variable for the option name

Create a variable called $myplugin_option_name and set it to the string 'myplugin_saved_message'.

Wordpress

    
        
        
        
    
    <?php
}

// Your code here

Need a hint?

Define $myplugin_option_name as 'myplugin_saved_message' outside the function.

3

Process the form submission with nonce check and sanitization

Add code that checks if the form was submitted by verifying isset($_POST['myplugin_nonce']) and wp_verify_nonce($_POST['myplugin_nonce'], 'myplugin_save_message'). If valid, sanitize the myplugin_message input using sanitize_text_field and save it with update_option using the variable $myplugin_option_name.

Wordpress

    
        
        
        
    
    <?php
}

$myplugin_option_name = 'myplugin_saved_message';

// Your code here

Need a hint?

Use sanitize_text_field to clean the input before saving with update_option.

4

Hook the form display function to the admin menu

Add a function called myplugin_admin_menu that uses add_menu_page to add a menu item titled 'My Plugin' with capability 'manage_options', slug 'myplugin', and callback myplugin_display_form. Then hook myplugin_admin_menu to the admin_menu action.

Wordpress

    
        
        
        
    
    <?php
}

$myplugin_option_name = 'myplugin_saved_message';

if (isset($_POST['myplugin_nonce']) && wp_verify_nonce($_POST['myplugin_nonce'], 'myplugin_save_message')) {
    $sanitized_message = sanitize_text_field($_POST['myplugin_message']);
    update_option($myplugin_option_name, $sanitized_message);
}

// Your code here

Need a hint?

Use add_menu_page inside myplugin_admin_menu and hook it to admin_menu.