Plugin security (nonces, sanitization) in Wordpress - Step-by-Step Execution

Concept Flow - Plugin security (nonces, sanitization)

User submits form

↓

Check nonce validity

↓

Sanitize input

↓

Process data

↓

Save or output safe data

This flow shows how WordPress plugins use nonces to verify requests and sanitize inputs to keep data safe before processing.

Execution Sample

Wordpress

<?php
if (isset($_POST['submit'])) {
  if (isset($_POST['_wpnonce']) && wp_verify_nonce($_POST['_wpnonce'], 'save_data')) {
    $safe_input = sanitize_text_field($_POST['user_input']);
    update_option('my_option', $safe_input);
  }
}
?>

This code checks a nonce from a form submission, sanitizes the user input, and saves it safely.

Execution Table

Step	Action	Input/Condition	_Result	Next Step
1	Form submitted	POST with _wpnonce and user_input	Data received	Check nonce
2	Verify nonce	_wpnonce matches 'save_data'	Nonce valid	Sanitize input
3	Sanitize input	Raw user_input	Cleaned user_input	Save data
4	Save data	Cleaned user_input	Option updated safely	End
5	If nonce invalid	_wpnonce does not match	Reject request	Show error message

💡 Execution stops after saving data or rejecting invalid nonce.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
_POST	empty	contains _wpnonce and user_input	same	same	same
nonce_check	undefined	undefined	true or false	true or false	true or false
user_input	undefined	raw input	raw input	sanitized input	sanitized input
saved_option	old value	old value	old value	old value	updated with sanitized input

Key Moments - 3 Insights

Why do we check the nonce before sanitizing input?

Checking the nonce first (see Step 2 in execution_table) ensures the request is legitimate before processing any data, preventing unauthorized actions.

What happens if the nonce is invalid?

If the nonce check fails (Step 5), the plugin rejects the request and does not sanitize or save data, protecting against CSRF attacks.

Why sanitize input even after nonce verification?

Nonce verification confirms request origin but does not clean data. Sanitization (Step 3) removes harmful content to prevent security issues like XSS.

Visual Quiz - 3 Questions

Look at the execution_table, what happens at Step 3?

A The user input is sanitized to remove unsafe characters.

B The nonce is verified to check request validity.

C The data is saved to the database.

D The request is rejected due to invalid nonce.

💡 Hint

Refer to the 'Action' and 'Result' columns in Step 3 of the execution_table.

At which step does the plugin reject the request if the nonce is invalid?

A Step 2

B Step 3

C Step 5

D Step 4

💡 Hint

Check the 'Action' and 'Result' columns for rejection in the execution_table.

If the user input is not sanitized, what risk increases?

A The nonce check will fail.

B The plugin might save unsafe data causing security issues.

C The form submission will be rejected.

D The plugin will automatically sanitize later.

💡 Hint

Look at the purpose of sanitization in the key_moments section.

Concept Snapshot

Plugin Security with Nonces and Sanitization:
- Use wp_verify_nonce() to check request authenticity.
- Always sanitize user inputs with functions like sanitize_text_field().
- Reject requests if nonce is invalid to prevent CSRF.
- Sanitization protects against harmful data like scripts.
- Process and save only verified and sanitized data.

Full Transcript

This lesson shows how WordPress plugins keep data safe by using nonces and sanitization. When a user submits a form, the plugin first checks the nonce to confirm the request is genuine. If the nonce is valid, it then cleans the user input to remove any harmful content. Only after these checks does the plugin save the data. If the nonce is invalid, the plugin rejects the request to stop unauthorized actions. Sanitization is important even after nonce checks because it protects against unsafe data that could cause security problems. This step-by-step flow helps beginners understand how to secure plugin data handling.

Practice

1. What is the main purpose of using a nonce in a WordPress plugin?

easy

A. To speed up the plugin loading time

B. To protect against unauthorized or fake form submissions

C. To style the plugin interface

D. To store user preferences permanently

Solution

1. Step 1: Understand what a nonce is

   A nonce is a unique token used to verify that a request comes from a trusted source.

2. Step 2: Identify nonce purpose in plugins

   Nonces prevent attackers from submitting fake or unauthorized requests to your plugin.

3. Final Answer:

   To protect against unauthorized or fake form submissions -> Option B

4. Quick Check:

   Nonce = Security token for requests [OK]

Hint: Nonces stop fake requests, like a secret handshake [OK]

Common Mistakes:

• Thinking nonce speeds up plugin
• Using nonce for styling
• Confusing nonce with data storage

2. Which of the following is the correct way to check a nonce in a WordPress plugin?

easy

A. check_nonce('my_nonce')

B. nonce_check('my_nonce')

C. wp_verify_nonce($_POST['my_nonce'], 'my_action')

D. verify_nonce('my_nonce')

Solution

1. Step 1: Recall the WordPress function for nonce verification

   The correct function to verify a nonce is wp_verify_nonce().

2. Step 2: Check the correct usage

   The function takes the nonce value and the action name as parameters, like wp_verify_nonce($_POST['my_nonce'], 'my_action').

3. Final Answer:

   wp_verify_nonce($_POST['my_nonce'], 'my_action') -> Option C

4. Quick Check:

   Verify nonce = wp_verify_nonce() [OK]

Hint: Use wp_verify_nonce() with nonce and action [OK]

Common Mistakes:

• Using non-existent functions like check_nonce
• Passing wrong parameters order
• Not using $_POST or $_GET to get nonce

3. What will be the output of this code snippet in a WordPress plugin?

if ( ! wp_verify_nonce($_POST['nonce'], 'save_data') ) {
  echo 'Invalid nonce';
} else {
  $name = sanitize_text_field($_POST['name']);
  echo 'Hello, ' . $name;
}

Assuming the nonce is valid and $_POST['name'] = '<script>alert(1)</script>John'?

medium

A. Hello, John

B. Hello, John

C. Invalid nonce

D. Hello, alert(1)John

Solution

1. Step 1: Check nonce validity

   The nonce is valid, so the else block runs.

2. Step 2: Understand sanitize_text_field effect

   This function removes HTML tags like <script>, so the input becomes 'alert(1)John' because sanitize_text_field removes tags but leaves the text inside.

3. Step 3: Clarify output

   The output will be 'Hello, alert(1)John' because the script tags are stripped but the text 'alert(1)' remains.

4. Final Answer:

   Hello, alert(1)John -> Option D

5. Quick Check:

   Sanitize removes tags but keeps text inside [OK]

Hint: sanitize_text_field strips HTML tags but keeps inner text [OK]

Common Mistakes:

• Assuming sanitize_text_field allows HTML
• Ignoring nonce check result
• Confusing output with raw input

4. Identify the error in this WordPress plugin code snippet:

if ( ! wp_verify_nonce($_POST['nonce'], 'save_data') ) {
  wp_die('Security check failed');
}
$name = sanitize_text_field($_POST['name']);
update_option('user_name', $name);

medium

A. Not checking if $_POST['name'] is set before sanitizing

B. Missing nonce field in the form

C. Using update_option instead of add_option

D. No error, code is correct

Solution

1. Step 1: Check nonce verification

   The nonce is verified correctly with wp_verify_nonce and wp_die on failure.

2. Step 2: Check input sanitization safety

   The code sanitizes $_POST['name'] without checking if it exists, which can cause a PHP notice or error.

3. Final Answer:

   Not checking if $_POST['name'] is set before sanitizing -> Option A

4. Quick Check:

   Always check input exists before sanitizing [OK]

Hint: Check if input exists before sanitize_text_field [OK]

Common Mistakes:

• Assuming update_option is wrong here
• Ignoring missing input checks
• Thinking nonce check is missing

5. You want to securely save a user email from a form in your WordPress plugin. Which combination of code snippets correctly uses nonce verification and sanitization?

// 1. Verify nonce
if ( ! wp_verify_nonce($_POST['nonce'], 'save_email') ) {
  wp_die('Invalid request');
}

// 2. Sanitize input
$email = ???

// 3. Save email
update_option('user_email', $email);

Choose the correct code for step 2:

hard

A. $email = sanitize_email($_POST['email']);

B. $email = sanitize_text_field($_POST['email']);

C. $email = esc_html($_POST['email']);

D. $email = wp_strip_all_tags($_POST['email']);

Solution

1. Step 1: Confirm nonce verification

   The nonce is verified correctly before processing input.

2. Step 2: Choose proper sanitization for email

   For emails, sanitize_email() is the correct function to clean and validate email format.

3. Step 3: Understand other options

   sanitize_text_field() is for plain text, esc_html() is for output escaping, and wp_strip_all_tags() removes tags but does not validate email.

4. Final Answer:

   $email = sanitize_email($_POST['email']); -> Option A

5. Quick Check:

   Email input = sanitize_email() [OK]

Hint: Use sanitize_email() for email inputs [OK]

Common Mistakes:

• Using sanitize_text_field for emails
• Confusing escaping with sanitizing
• Not verifying nonce before saving