Webinar - From Good to Great: Coding Standards and WordPress

#wpewebinar
February 28, 2018
#wpewebinar

#wpewebinar
CROP IMAGE
TO GRAY BOX
We’ll answer as many questions as we can after
the presentation
ASK QUESTIONS AS WE GO
Slides and recording will be
made available shortly after
the webinar
Use the “Questions” pane
throughout the webinar

#wpewebinar
WHAT YOU’LL LEARN:
● Why coding standards are important
● Common mistakes even good developers make
● Tips for becoming an even better developer
● Resources available to learn more
● What Tide is and what’s coming to WordPress.org
● Q&A

#wpewebinar
Director of Product & Innovation
XWP
Luke Carbis
● Film photography hobbyist
● Bullet Journal devotee
● Has lived in Rome and Jerusalem
(now in Brisbane)
Innovation Program Manager
WP Engine
Steven Word
● Makes Instrumental Hip-Hop
● Loves Hiking
● Craft Beer Enthusiast

Luke Carbis
From Good to Great
Coding Standards and WordPress

Scripts & Styles
Prefixing
Sanitising & Escaping
Formatting Standards

But… why?
If it ‘aint broke, why fix it?
— Terrible advice of unknown origin.

Wordpress
What’s wrong here?

Why are these conventions so important, anyway?
● Prevent conflicts

● Prevent loading unnecessary files

● Readability

● Readability
● Maintainability

● Readability
● Maintainability
● Prevent conflicts with other plugins
● Automatic minification
● Dependencies loaded
● Include all WordPress functionality
● Handling security nonces correctly
● Prevent SQL injection attacks
● Encourage community support

Better, Faster, and Stronger.
Best practices exist to make your site

Learn to write code you can be proud of.

Do not…
add html directly into your theme:
or
or even
<link href="style.css" rel="stylesheet" type="text/css" />
<script type="text/javascript">
var foo = 'bar';
</script>
<script src="//code.jquery.com/jquery-latest.min.js"></script>

This is better:
In your plugin, or in your functions.php file, use the wp_enqueue_script and wp_enqueue_style
functions:
wp_register_script( 'select2', get_template_directory_uri() . 'ui/select2/select2.m
wp_register_style( 'select2', get_template_directory_uri() . 'ui/select2/select2.cs
wp_enqueue_script( 'select2' );
wp_enqueue_style( 'select2' );
wp_enqueue_script( 'my-script', 'ui/main.js', array( 'jquery', 'select2', 'heartbea
or

This is even better:
Wrap your wp_enqueue_script and _style calls in a function, which fires at the right time.
add_action( 'wp_enqueue_scripts', 'my_plugin_enqueue_scripts' ) );
my_plugin_enqueue_scripts() {
wp_register_script( 'select2', get_template_directory_uri() . 'ui/select2/selec
wp_register_style( 'select2', get_template_directory_uri() . 'ui/select2/select
wp_enqueue_script( 'select2' );
wp_enqueue_style( 'select2' );
}

Do not name your functions
custom_meta_box()
or
save_options()

This is better:
my_plugin_custom_meta_box()
or
my_plugin_save_options()

This is even better
class Akismet {
function init() {
// …
}
function save() {
// …
}
}
$GLOBALS['akismet'] = new Akismet;

Don’t do this:
echo $permalink;
Do this:
echo esc_url( $permalink );
Escape Outputs

Don’t do this:
Do this:
$foo = $_GET[ 'foo' ];
$bar = $_GET[ 'bar' ];
echo '<p id="' . $foo . '">' . $bar . '</p>';
echo wp_kses_post(
sprintf(
'<p id="%s">%s</p>',
esc_attr( $_GET[ 'foo' ] ),
esc_html( $_GET[ 'bar' ] )
)
);
Escape Outputs

Don’t do this:
Do this:
Sanitise Inputs
$title = $_POST['title'];
update_post_meta( $post->ID, 'title', $title );
$title = sanitize_text_field( $_POST['title'] );
update_post_meta( $post->ID, 'title', $title );

Don’t do this:
Do this:
Sanitise Inputs
$secondary_email = $_POST[ 'email' ];
update_user_meta( $user_id, 'secondary_email', $secondary_email );
$secondary_email = sanitize_email( $_POST[ 'email' ] );
update_user_meta( $user_id, 'secondary_email', $secondary_email );

Sanitise with $wpdb
This is one way of getting all posts attributed to a particular author:
global $wpdb;
$post_author = $_POST['author_id'];
$results = $wpdb->get_results(
"SELECT ID, post_title
FROM $wpdb->posts
WHERE post_status = 'publish' AND post_author = $post_author"
);

Sanitise with $wpdb
This is a safer way of doing the same thing:
global $wpdb;
$post_author = intval( $_POST['author_id'] );
$results = $wpdb->get_results(
$wpdb->prepare(
"SELECT ID, post_title
FROM $wpdb->posts
WHERE post_status = %s AND post_author = %d",
'publish',
$post_author
)
);

Indentation
Use real tabs and not spaces.

Yoda Conditions
if ( true === $the_force ) {
$victorious = you_will( $be );
}

This is clever:
Clever Code
isset( $var ) || $var = some_function();
But this is readable:
if ( ! isset( $var ) ) {
$var = some_function();
}

Always use braces, even where not required.
Not this:
Braces
if ( condition() )
return true;
if ( condition() ) {
return true;
}
This:

Tide
Tide is a series of automated tests run against every plugin and
theme in the WordPress directory.
Tide currently tests for Coding Standards and PHP Compatibility.
https://make.wordpress.org/tide

PHP CodeSniffer
with WordPress Coding Standards rules
https://github.com/WordPress-Coding-Standards/

#wpewebinar
Slides and recording will be made available
shortly after the webinar
QUESTIONS AND ANSWERS

#wpewebinar
RESOURCES
Tide: A Path to Better Code Across the WordPress Ecosystem
Webinar Links, Snippets and Resources
WordPress Coding Standards Handbook - WordPress.org
Tide

#wpewebinar
CROP IMAGE
TO GRAY BOX
NEXT UP...
Register Now:
http://wpeng.in/
ml-wp
Wednesday, Mar 7
11:00 a.m. CST,
12:00 p.m. EST,
9:00 a.m. PST,
17:00 UTC/GMT

#wpewebinar
THANK YOU
#wpewebinar
@wpengine

Webinar - From Good to Great: Coding Standards and WordPress

Recomendados

Recomendados

Más contenido relacionado

Más de WP Engine

Más de WP Engine (20)

Último

Último (20)

Webinar - From Good to Great: Coding Standards and WordPress