You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: wordpress-coding-standards/php.md
+24-24Lines changed: 24 additions & 24 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,9 +2,9 @@
2
2
3
3
Some parts of the WordPress code structure for PHP markup are inconsistent in their style. WordPress is working to gradually improve this by helping users maintain a consistent style so the code can become clean and easy to read at a glance.
4
4
5
-
Keep the following points in mind when writing PHP code for WordPress, whether for core programming code, plugins, or themes. The guidelines are similar to <ahref="http://pear.php.net/manual/en/standards.php">Pear standards</a> in many ways, but differ in some key respects.
5
+
Keep the following points in mind when writing PHP code for WordPress, whether for core programming code, plugins, or themes. The guidelines are similar to [Pear standards](https://pear.php.net/manual/en/standards.php) in many ways, but differ in some key respects.
6
6
7
-
See also: <ahref="https://developer.wordpress.org/coding-standards/inline-documentation-standards/php/">PHP Documentation Standards</a>.
7
+
See also: [PHP Inline Documentation Standards](https://developer.wordpress.org/coding-standards/inline-documentation-standards/php/).
Text that goes into attributes should be run through `esc_attr()` so that single or double quotes do not end the attribute value and invalidate the HTML and cause a security issue. See <ahref="http://codex.wordpress.org/Data_Validation">Data Validation</a> in the Codex for further details.
20
+
Text that goes into attributes should be run through `esc_attr()` so that single or double quotes do not end the attribute value and invalidate the HTML and cause a security issue. See [Data Validation](https://developer.wordpress.org/plugins/security/data-validation/) in the Plugin Handbook for further details.
21
21
22
22
### Indentation
23
23
@@ -111,7 +111,7 @@ foreach ( $items as $item ) {
111
111
}
112
112
```
113
113
114
-
Note that requiring the use of braces just means that <em>single-statement inline control structures</em> are prohibited. You are free to use the <ahref="http://php.net/manual/en/control-structures.alternative-syntax.php"rel="nofollow">alternative syntax for control structures</a> (e.g. `if`/`endif`, `while`/`endwhile`)—especially in your templates where PHP code is embedded within HTML, for instance:
114
+
Note that requiring the use of braces just means that <em>single-statement inline control structures</em> are prohibited. You are free to use the [alternative syntax for control structures](https://www.php.net/manual/en/control-structures.alternative-syntax.php) (e.g. `if`/`endif`, `while`/`endwhile`)—especially in your templates where PHP code is embedded within HTML, for instance:
Closures must not be passed as filter or action callbacks, as they cannot be removed by `remove_action()` / `remove_filter()` (see <ahref="https://core.trac.wordpress.org/ticket/46635">#46635</a> for a proposal to address this).
152
+
Closures must not be passed as filter or action callbacks, as they cannot be removed by `remove_action()` / `remove_filter()` (see [#46635](https://core.trac.wordpress.org/ticket/46635"Improve identifying of non–trivial callbacks in hooks") for a proposal to address this).
153
153
154
154
### Multiline Function Calls
155
155
@@ -178,7 +178,7 @@ $a = foo(
178
178
179
179
### Regular Expressions
180
180
181
-
Perl compatible regular expressions (<ahref="http://php.net/pcre">PCRE</a>, `preg_` functions) should be used in preference to their POSIX counterparts. Never use the `/e` switch, use `preg_replace_callback` instead.
181
+
Perl compatible regular expressions ([PCRE](https://www.php.net/pcre), `preg_` functions) should be used in preference to their POSIX counterparts. Never use the `/e` switch, use `preg_replace_callback` instead.
182
182
183
183
It's most convenient to use single-quoted strings for regular expressions since, contrary to double-quoted strings, they have only two metasequences: `\'` and `\\`.
184
184
@@ -279,7 +279,7 @@ When performing logical comparisons, do it like so:
279
279
if ( ! $foo ) { ...
280
280
```
281
281
282
-
<atitle="type casting"href="http://www.php.net/manual/en/language.types.type-juggling.php#language.types.typecasting"target="_blank">Type casts</a> must be lowercase. Always prefer the short form of type casts, `(int)` instead of `(integer)` and `(bool)` rather than `(boolean)`. For float casts use `(float)`.:
282
+
[Type casts](https://www.php.net/manual/en/language.types.type-juggling.php#language.types.typecasting) must be lowercase. Always prefer the short form of type casts, `(int)` instead of `(integer)` and `(bool)` rather than `(boolean)`. For float casts use `(float)`.:
283
283
284
284
```php
285
285
foreach ( (array) $foo as $bar ) { ...
@@ -340,15 +340,15 @@ $id = some_foo_number(); // data we expect to be an integer, but we're not certa
340
340
$wpdb->query( $wpdb->prepare( "UPDATE $wpdb->posts SET post_title = %s WHERE ID = %d", $var, $id ) );
341
341
```
342
342
343
-
`%s` is used for string placeholders and `%d` is used for integer placeholders. Note that they are not 'quoted'! `$wpdb->prepare()` will take care of escaping and quoting for us. The benefit of this is that we don't have to remember to manually use `<a href="https://developer.wordpress.org/reference/functions/esc_sql/">esc_sql</a>()`, and also that it is easy to see at a glance whether something has been escaped or not, because it happens right when the query happens.
343
+
`%s` is used for string placeholders and `%d` is used for integer placeholders. Note that they are not 'quoted'! `$wpdb->prepare()` will take care of escaping and quoting for us. The benefit of this is that we don't have to remember to manually use [`esc_sql()`](https://developer.wordpress.org/reference/functions/esc_sql/), and also that it is easy to see at a glance whether something has been escaped or not, because it happens right when the query happens.
344
344
345
-
See <atitle="Data Validation"href="http://codex.wordpress.org/Data_Validation"target="_blank">Data Validation</a> in the Codex for more information.
345
+
See [Data Validation](https://developer.wordpress.org/plugins/security/data-validation/) in the Plugin Handbook for further details.
346
346
347
347
### Database Queries
348
348
349
349
Avoid touching the database directly. If there is a defined function that can get the data you need, use it. Database abstraction (using functions instead of queries) helps keep your code forward-compatible and, in cases where results are cached in memory, it can be many times faster.
350
350
351
-
If you must touch the database, get in touch with some developers by posting a message to the <atitle="wp-hackers mailing list"href="http://codex.wordpress.org/Mailing_Lists#Hackers"target="_blank">wp-hackers mailing list</a>. They may want to consider creating a function for the next WordPress version to cover the functionality you wanted.
351
+
If you must touch the database, get in touch with some developers by posting a message to the [wp-hackers mailing list](https://codex.wordpress.org/Mailing_Lists#Hackers). They may want to consider creating a function for the next WordPress version to cover the functionality you wanted.
352
352
353
353
### Naming Conventions
354
354
@@ -466,7 +466,7 @@ Where possible, dynamic values in tag names should also be as succinct and to th
466
466
467
467
### Ternary Operator
468
468
469
-
<atitle="Ternary"href="http://en.wikipedia.org/wiki/Ternary_operation"target="_blank">Ternary</a> operators are fine, but always have them test if the statement is true, not false. Otherwise, it just gets confusing. (An exception would be using `! empty()`, as testing for false here is generally more intuitive.)
469
+
[Ternary operators](https://www.php.net/manual/en/language.operators.comparison.php#language.operators.comparison.ternary) are fine, but always have them test if the statement is true, not false. Otherwise, it just gets confusing. (An exception would be using `! empty()`, as testing for false here is generally more intuitive.)
470
470
471
471
The short ternary operator must not be used.
472
472
@@ -486,7 +486,7 @@ if ( true === $the_force ) {
486
486
}
487
487
```
488
488
489
-
When doing logical comparisons involving variables, always put the variable on the right side and put constants, literals, or function calls on the left side. If neither side is a variable, the order is not important. (In <ahref="https://en.wikipedia.org/wiki/Value_(computer_science)#Assignment:_l-values_and_r-values">computer science terms</a>, in comparisons always try to put l-values on the right and r-values on the left.)
489
+
When doing logical comparisons involving variables, always put the variable on the right side and put constants, literals, or function calls on the left side. If neither side is a variable, the order is not important. (In [computer science terms](https://en.wikipedia.org/wiki/Value_(computer_science)#Assignment:_l-values_and_r-values), in comparisons always try to put l-values on the right and r-values on the left.)
490
490
491
491
In the above example, if you omit an equals sign (admit it, it happens even to the most seasoned of us), you'll get a parse error, because you can't assign to a constant like `true`. If the statement were the other way around `( $the_force = true )`, the assignment would be perfectly valid, returning `1`, causing the if statement to evaluate to `true`, and you could be chasing that bug for a while.
492
492
@@ -572,29 +572,29 @@ The `eval()` construct is <em>very dangerous</em>, and is impossible to secure.
572
572
573
573
### Error Control Operator `@`
574
574
575
-
As noted in the <ahref="http://www.php.net//manual/en/language.operators.errorcontrol.php">PHP docs</a>:
575
+
As noted in the [PHP docs](https://www.php.net/manual/en/language.operators.errorcontrol.php):
576
+
576
577
<blockquote>PHP supports one error control operator: the at sign (@). When prepended to an expression in PHP, any error messages that might be generated by that expression will be ignored.</blockquote>
578
+
577
579
While this operator does exist in Core, it is often used lazily instead of doing proper error checking. Its use is highly discouraged, as even the PHP docs also state:
580
+
578
581
<blockquote>Warning: Currently the "@" error-control operator prefix will even disable error reporting for critical errors that will terminate script execution. Among other things, this means that if you use "@" to suppress errors from a certain function and either it isn't available or has been mistyped, the script will die right there with no indication as to why.</blockquote>
579
582
580
583
### Don't `extract()`
581
584
582
-
Per <atitle="Remove all, or at least most, uses of extract() within WordPress"href="https://core.trac.wordpress.org/ticket/22400">#22400</a>:
585
+
Per [#22400](https://core.trac.wordpress.org/ticket/22400"Remove all, or at least most, uses of extract() within WordPress"):
583
586
<blockquote>`extract()` is a terrible function that makes code harder to debug and harder to understand. We should discourage it's [sic] use and remove all of our uses of it.
587
+
</blockquote>
584
588
585
-
Joseph Scott has <aclass="ext-link"href="https://blog.josephscott.org/2009/02/05/i-dont-like-phps-extract-function/">a good write-up of why it's bad</a>.</blockquote>
589
+
Joseph Scott has [a good write-up of why it's bad](https://blog.josephscott.org/2009/02/05/i-dont-like-phps-extract-function/).
<li>November 13, 2013: <ahref="http://make.wordpress.org/core/2013/11/13/proposed-coding-standards-change-always-require-braces/">Braces should always be used, even when they are optional</a></li>
597
-
<li>June 20, 2014: Add <ahref="#error-control-operator">section</a> to discourage use of the <ahref="http://www.php.net//manual/en/language.operators.errorcontrol.php">error control operator</a> (`@`). See <ahref="https://irclogs.wordpress.org/chanlog.php?channel=wordpress-dev&day=2014-06-20&sort=asc#m873356">#wordpress-dev</a>.</li>
598
-
<li>October 20, 2014: Update brace usage to indicate that the alternate syntax for control structures is allowed, even encouraged. It is single-line inline control structures that are forbidden.</li>
599
-
<li>January 21, 2014: Add section to forbid extract().</li>
600
-
</ul>
597
+
- November 13, 2013: [Braces should always be used, even when they are optional](https://make.wordpress.org/core/2013/11/13/proposed-coding-standards-change-always-require-braces/)
598
+
- June 20, 2014: Add (#error-control-operator) to discourage use of the [error control operator]((https://www.php.net/manual/en/language.operators.errorcontrol.php)) (`@`). See [#wordpress-dev](https://irclogs.wordpress.org/chanlog.php?channel=wordpress-dev&day=2014-06-20&sort=asc#m873356).
599
+
- October 20, 2014: Update brace usage to indicate that the alternate syntax for control structures is allowed, even encouraged. It is single-line inline control structures that are forbidden.
600
+
- January 21, 2014: Add section to forbid extract().
0 commit comments