User capability checks in Wordpress - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user without 'edit_posts' capability tries to access this code?

Consider this WordPress PHP snippet inside a plugin or theme:

if ( current_user_can('edit_posts') ) {
    echo 'You can edit posts!';
} else {
    echo 'Access denied.';
}

What will be the output if the current user does NOT have the 'edit_posts' capability?

Wordpress

if ( current_user_can('edit_posts') ) {
    echo 'You can edit posts!';
} else {
    echo 'Access denied.';
}

A You can edit posts!

B Fatal error: undefined function current_user_can()

C Access denied.

D No output at all

💡 Hint

Think about what current_user_can() returns when the user lacks the capability.

The function current_user_can('edit_posts') returns false if the user does not have that capability. So the else block runs, printing 'Access denied.'

📝 Syntax

intermediate

Which option correctly checks if a user can 'manage_options' in WordPress?

Choose the correct PHP code snippet that checks if the current user has the 'manage_options' capability.

A if (current_user_can('manage_options')) { /* code */ }

B if (user_can('manage_options')) { /* code */ }

C if (current_user_can = 'manage_options') { /* code */ }

D if (current_user_can('manage_options') == false) { /* code */ }

💡 Hint

Remember the correct function name and syntax for capability checks.

The correct function is current_user_can() with the capability as a string argument. Option A uses this correctly.

Option A uses a wrong function name. Option A assigns instead of compares. Option A checks for false, which is valid but not the direct check asked.

❓ state_output

advanced

What is the output of this code when the user is logged out?

Analyze this WordPress PHP snippet:

if ( is_user_logged_in() && current_user_can('publish_posts') ) {
    echo 'Welcome, author!';
} else {
    echo 'Please log in.';
}

What will it output if the user is NOT logged in?

Wordpress

if ( is_user_logged_in() && current_user_can('publish_posts') ) {
    echo 'Welcome, author!';
} else {
    echo 'Please log in.';
}

A Welcome, author!

B Please log in.

C No output

D Fatal error: call to current_user_can() without user

💡 Hint

Consider how is_user_logged_in() affects the condition.

If the user is not logged in, is_user_logged_in() returns false, so the whole condition is false and the else block runs, printing 'Please log in.'

🔧 Debug

advanced

Why does this capability check always fail?

Look at this code snippet:

if ( current_user_can( 'edit_post' ) ) {
    echo 'Can edit post';
} else {
    echo 'Cannot edit post';
}

Why does it always print 'Cannot edit post' even for users who can edit posts?

Wordpress

if ( current_user_can( 'edit_post' ) ) {
    echo 'Can edit post';
} else {
    echo 'Cannot edit post';
}

A The echo statements are reversed.

B The function current_user_can() requires a user ID as second argument.

C The code is missing a call to wp_get_current_user() before checking.

D The capability name 'edit_post' is incorrect; it should be 'edit_posts'.

💡 Hint

Check the exact capability string spelling.

The capability 'edit_post' does not exist in WordPress. The correct capability is 'edit_posts' (plural). So the check always fails.

🧠 Conceptual

expert

Which statement about user capability checks in WordPress is TRUE?

Choose the correct statement about how WordPress handles user capability checks.

A current_user_can() checks capabilities only for the currently logged-in user and returns false if no user is logged in.

B current_user_can() can check capabilities for any user by passing a user ID as the second argument.

C User capabilities are stored in the database as plain text and checked directly by current_user_can().

D If a user lacks a capability, current_user_can() throws a fatal error.

💡 Hint

Think about the function's behavior when no user is logged in.

current_user_can() checks capabilities only for the current logged-in user. If no user is logged in, it returns false. It does not accept a user ID argument. Capabilities are stored serialized in the database and checked internally. It never throws fatal errors for missing capabilities.