Matt Fiddles

Life's so vast, there's just so much to do...

User Tools

Site Tools


Sidebar

C-3PO: "R2 says that the chances of survival are 725 to 1. Actually R2 has been known to make mistakes - from time to time... Oh dear..."



Where will you go today?

"The story goes that I first had the idea for THHGTTG while lying drunk in a field in Innsbruck (or `Spain' as the BBC TV publicity department authoritatively has it, probably because it's easier to spell)." - Foreward by DNA.

FORD Six pints of bitter. And quickly please, the world's about to end.
BARMAN Oh yes, sir? Nice weather for it.
Action disabled: source
computers:websites:wordpress:nonce-security

Wordpress nonce

These help to give security to WordPress.

wp_nonce_field( $action, $name, $referer, $echo )

Like this:

  <form method="post">
    <!-- some inputs here ... -->
    <?php wp_nonce_field( 'name_of_my_action', 'name_of_nonce_field' ); ?>
  </form>

Then we can verify it:

if ( 
    ! isset( $_POST['name_of_nonce_field'] ) 
    || ! wp_verify_nonce( $_POST['name_of_nonce_field'], 'name_of_my_action' ) 
) {
 
   print 'Sorry, your nonce did not verify.';
   exit;
 
} else {
 
   // process form data
}

Also, try using wp referer field() and wp_get_referer() to verify where the submission came from.

And for admin pages, use check_admin_referer();

WordPress Front End Security: CSRF and Nonces https://css-tricks.com/wordpress-front-end-security-csrf-and-nonces/

computers/websites/wordpress/nonce-security.txt · Last modified: Apr 5, 2015 (4 years ago) by Matt Bagley