Plugin security (nonces, sanitization) in Wordpress - Mini Project: Build & Apply

Secure WordPress Plugin with Nonces and Sanitization

📖 Scenario: You are building a simple WordPress plugin that adds a form to the admin dashboard. This form lets the admin enter a message that will be saved as an option. To keep the plugin safe, you need to use WordPress security features like nonces to protect the form from unauthorized submissions and sanitize the input to avoid harmful data.

🎯 Goal: Create a WordPress plugin that shows a form in the admin area. The form must use a nonce field for security and sanitize the input before saving it. This will protect the plugin from attacks and keep the data clean.

📋 What You'll Learn

Create a function to display a form with a nonce field

Add a configuration variable for the option name

Process the form submission using nonce verification and sanitize_text_field

Hook the form display function to the admin menu

💡 Why This Matters

🌍 Real World

WordPress plugins often handle user input and need to protect against attacks like CSRF and XSS. Using nonces and sanitization is essential for plugin security.

💼 Career

Understanding how to secure WordPress plugins is important for developers working with WordPress to prevent vulnerabilities and protect user data.

1

Create the form display function with a nonce field

Create a function called myplugin_display_form that outputs a simple HTML form with a textarea named myplugin_message and includes a nonce field using wp_nonce_field with action myplugin_save_message and name myplugin_nonce.

Wordpress

# Your code here

Hint

Use wp_nonce_field('myplugin_save_message', 'myplugin_nonce') inside the form to add the nonce.

2

Add a configuration variable for the option name

Create a variable called $myplugin_option_name and set it to the string 'myplugin_saved_message'.

Wordpress

    
        
        
        
    
    <?php
}

// Your code here

Hint

Define $myplugin_option_name as 'myplugin_saved_message' outside the function.

3

Process the form submission with nonce check and sanitization

Add code that checks if the form was submitted by verifying isset($_POST['myplugin_nonce']) and wp_verify_nonce($_POST['myplugin_nonce'], 'myplugin_save_message'). If valid, sanitize the myplugin_message input using sanitize_text_field and save it with update_option using the variable $myplugin_option_name.

Wordpress

    
        
        
        
    
    <?php
}

$myplugin_option_name = 'myplugin_saved_message';

// Your code here

Hint

Use sanitize_text_field to clean the input before saving with update_option.

4

Hook the form display function to the admin menu

Add a function called myplugin_admin_menu that uses add_menu_page to add a menu item titled 'My Plugin' with capability 'manage_options', slug 'myplugin', and callback myplugin_display_form. Then hook myplugin_admin_menu to the admin_menu action.

Wordpress

    
        
        
        
    
    <?php
}

$myplugin_option_name = 'myplugin_saved_message';

if (isset($_POST['myplugin_nonce']) && wp_verify_nonce($_POST['myplugin_nonce'], 'myplugin_save_message')) {
    $sanitized_message = sanitize_text_field($_POST['myplugin_message']);
    update_option($myplugin_option_name, $sanitized_message);
}

// Your code here

Hint

Use add_menu_page inside myplugin_admin_menu and hook it to admin_menu.

Practice

1. What is the main purpose of using a nonce in a WordPress plugin?

easy

A. To speed up the plugin loading time

B. To protect against unauthorized or fake form submissions

C. To style the plugin interface

D. To store user preferences permanently

Solution

1. Step 1: Understand what a nonce is

   A nonce is a unique token used to verify that a request comes from a trusted source.

2. Step 2: Identify nonce purpose in plugins

   Nonces prevent attackers from submitting fake or unauthorized requests to your plugin.

3. Final Answer:

   To protect against unauthorized or fake form submissions -> Option B

4. Quick Check:

   Nonce = Security token for requests [OK]

Hint: Nonces stop fake requests, like a secret handshake [OK]

Common Mistakes:

• Thinking nonce speeds up plugin
• Using nonce for styling
• Confusing nonce with data storage

2. Which of the following is the correct way to check a nonce in a WordPress plugin?

easy

A. check_nonce('my_nonce')

B. nonce_check('my_nonce')

C. wp_verify_nonce($_POST['my_nonce'], 'my_action')

D. verify_nonce('my_nonce')

Solution

1. Step 1: Recall the WordPress function for nonce verification

   The correct function to verify a nonce is wp_verify_nonce().

2. Step 2: Check the correct usage

   The function takes the nonce value and the action name as parameters, like wp_verify_nonce($_POST['my_nonce'], 'my_action').

3. Final Answer:

   wp_verify_nonce($_POST['my_nonce'], 'my_action') -> Option C

4. Quick Check:

   Verify nonce = wp_verify_nonce() [OK]

Hint: Use wp_verify_nonce() with nonce and action [OK]

Common Mistakes:

• Using non-existent functions like check_nonce
• Passing wrong parameters order
• Not using $_POST or $_GET to get nonce

3. What will be the output of this code snippet in a WordPress plugin?

if ( ! wp_verify_nonce($_POST['nonce'], 'save_data') ) {
  echo 'Invalid nonce';
} else {
  $name = sanitize_text_field($_POST['name']);
  echo 'Hello, ' . $name;
}

Assuming the nonce is valid and $_POST['name'] = '<script>alert(1)</script>John'?

medium

A. Hello, John

B. Hello, John

C. Invalid nonce

D. Hello, alert(1)John

Solution

1. Step 1: Check nonce validity

   The nonce is valid, so the else block runs.

2. Step 2: Understand sanitize_text_field effect

   This function removes HTML tags like <script>, so the input becomes 'alert(1)John' because sanitize_text_field removes tags but leaves the text inside.

3. Step 3: Clarify output

   The output will be 'Hello, alert(1)John' because the script tags are stripped but the text 'alert(1)' remains.

4. Final Answer:

   Hello, alert(1)John -> Option D

5. Quick Check:

   Sanitize removes tags but keeps text inside [OK]

Hint: sanitize_text_field strips HTML tags but keeps inner text [OK]

Common Mistakes:

• Assuming sanitize_text_field allows HTML
• Ignoring nonce check result
• Confusing output with raw input

4. Identify the error in this WordPress plugin code snippet:

if ( ! wp_verify_nonce($_POST['nonce'], 'save_data') ) {
  wp_die('Security check failed');
}
$name = sanitize_text_field($_POST['name']);
update_option('user_name', $name);

medium

A. Not checking if $_POST['name'] is set before sanitizing

B. Missing nonce field in the form

C. Using update_option instead of add_option

D. No error, code is correct

Solution

1. Step 1: Check nonce verification

   The nonce is verified correctly with wp_verify_nonce and wp_die on failure.

2. Step 2: Check input sanitization safety

   The code sanitizes $_POST['name'] without checking if it exists, which can cause a PHP notice or error.

3. Final Answer:

   Not checking if $_POST['name'] is set before sanitizing -> Option A

4. Quick Check:

   Always check input exists before sanitizing [OK]

Hint: Check if input exists before sanitize_text_field [OK]

Common Mistakes:

• Assuming update_option is wrong here
• Ignoring missing input checks
• Thinking nonce check is missing

5. You want to securely save a user email from a form in your WordPress plugin. Which combination of code snippets correctly uses nonce verification and sanitization?

// 1. Verify nonce
if ( ! wp_verify_nonce($_POST['nonce'], 'save_email') ) {
  wp_die('Invalid request');
}

// 2. Sanitize input
$email = ???

// 3. Save email
update_option('user_email', $email);

Choose the correct code for step 2:

hard

A. $email = sanitize_email($_POST['email']);

B. $email = sanitize_text_field($_POST['email']);

C. $email = esc_html($_POST['email']);

D. $email = wp_strip_all_tags($_POST['email']);

Solution

1. Step 1: Confirm nonce verification

   The nonce is verified correctly before processing input.

2. Step 2: Choose proper sanitization for email

   For emails, sanitize_email() is the correct function to clean and validate email format.

3. Step 3: Understand other options

   sanitize_text_field() is for plain text, esc_html() is for output escaping, and wp_strip_all_tags() removes tags but does not validate email.

4. Final Answer:

   $email = sanitize_email($_POST['email']); -> Option A

5. Quick Check:

   Email input = sanitize_email() [OK]

Hint: Use sanitize_email() for email inputs [OK]

Common Mistakes:

• Using sanitize_text_field for emails
• Confusing escaping with sanitizing
• Not verifying nonce before saving