Comments on: WordPress Plugin Pet Peeve #2: Direct Calls to Plugin Files

By: michaelwender.com » An In-Depth Introduction to my First Commercial WordPress Theme

Tue, 26 Jul 2011 16:10:44 +0000

[…] Using jQuery to Query Featured Images To achieve these goals, I began coding the front-end using jQuery. Then for my AJAX calls, I added code to my theme’s functions.php so that WordPress could receive my query requests directly. This meant my AJAX calls could reference the theme’s main URL (e.g. http://example.com?action=getimage) rather than referencing some additional PHP file setup to specifically handle AJAX requests (for more info on this, check out this post by Will Norris). […]

By: John Eckman

John Eckman — Sat, 09 Jan 2010 23:34:04 +0000

Thanks for this great series, Will - I've updated WPBook to comply with them (I think!).

When constructing in code the full url that will be used (example.com/index.php in your example), is it better to use get_bloginfo('wpurl') or get_bloginfo('home')?

That is, do I need to point at index.php in the directory where WordPress is installed or the index.php where they set their home url to be, in cases where they've moved WordPress into a subdirectory?

By: WPBook 1.4 Released | Open Parenthesis

WPBook 1.4 Released | Open Parenthesis — Mon, 04 Jan 2010 15:20:52 +0000

[…] Removed hard coded reference to config.php, routing Facebook comment submission through WordPress’ built in query parser instead (See http://willnorris.com/2009/06/wordpress-plugin-pet-peeve-2-direct-calls-to-plugin-files) […]

By: Will Norris

Will Norris — Tue, 17 Nov 2009 18:41:10 +0000

Olivier: the only way you would need something like require_once('../../../wp-config.php') in your code is if you are calling your plugin files directly, and they need access to WP functions. This is really bad, you never want to do this.

So instead of calling your plugin file directly, and having it try to bootstrap the WP environment, what you want to do is actually send the request through WordPress (so the environment gets setup properly) and then have the requested passed off to your plugin to process it. You accomplish the same thing, but this is the Right Way to do it.

The AJAX in Plugins Codex page suggests that you can still use /wp-admin/admin-ajax.php to process user facing AJAX calls. I was thinking that wasn't possibly, but I certainly could be wrong... might be worth looking into.

By: Kiper IT-konsult

Kiper IT-konsult — Tue, 17 Nov 2009 18:00:48 +0000

Thank you Will for this great post and thanks to Alex that posted about it so I could find it! I have been delving deeper and deeper under the hood of WP lately and it is great to find articles that are so clear and to the point. It is sometimes hard to see the forest for all the trees…

By: Olivier

Olivier — Tue, 17 Nov 2009 11:41:25 +0000

Sorry, I see that my comment has been truncated. Before the admin-ajax call, I am echoing the site_url path.

By: Olivier

Olivier — Tue, 17 Nov 2009 11:38:11 +0000

Hello,

Great post however I am not really clear on how to deal with the : require_once('../../../wp-config.php');

I need to use the get_option function to get the site url which I then use in an ajax call : jQuery.post("/wp-admin/admin-ajax.php"...

I have been through the methods you suggest but I don't really understand. The codex describes the method to perform Ajax calls on the admin and frontend sides. You need to include the wp-config.php to get the site url... I fully agree on the fact that this may cause some problems if the installation uses non standard paths but I don't get from your note the way to deal with that... I should have missed something...

By: No more direct calls at alex.rabe

No more direct calls at alex.rabe — Mon, 16 Nov 2009 12:17:10 +0000

[…] be the solution for my problems and in the same second I spin my ideas he linked to an article from Will Norris. I never ever get the same idea since I wrote my first plugin, it’s really simple to realize […]

By: Will Norris

Will Norris — Mon, 20 Jul 2009 17:54:27 +0000

both wp_mail and wp_verify_nonce are defined in pluggable.php which is loaded before either of those hooks. If you're seeing an error about the functions being undefined, it must be caused by something else.

By: Rajeevan

Rajeevan — Fri, 17 Jul 2009 06:50:14 +0000

Okay, I got to admit I've been doing this dirty trick on my plugin for a while now. After reading this, I've converted to using HOOK to "parse_request".

But there comes errors, My plugin uses wp_mail() and wp_verify_nonce()! Both failed as Undefined functions? so I try changing the parse_request HOOK to 'wp'. Same result, I guess this method have its limit!