WordPress 2.7 requires that plugins explicitly white list their options using a couple new functions. WordPress MU has required this security measure for a while, and it’s nice to see an evolved form of it brought to the core code. Migrating Plugins and Themes to 2.7 article in the codex offers some guidance, but here’s how it works:

First, register each option for your plugin during the admin_init action:

function myplugin_admin_init(){
	register_setting( 'my-options-group', 'my-option-name-1', 'absint' );
	register_setting( 'my-options-group', 'my-option-name-2', 'wp_filter_nohtml_kses' );
}
add_action( 'admin_init', 'myplugin_admin_init' );

In the example above, the value for my-option-name-1 will be filtered by absint before being saved to the options table. my-option-name-2 will be stripped of any HTML by wp_filter_nohtml_kses.

Then build a form like this prototype:

<form method="post" action="options.php">
 
<?php settings_fields('my-options-group'); ?>
 
<input name="my-option-name-1" id="my-option-name-1" type="checkbox" value="1" <?php checked('1', get_option('bsuite_insert_related')); ?> />
 
<input name="my-option-name-2" id="my-option-name-2" type="text" value="<?php format_to_edit( get_option( 'bsuite_insert_related' )) ?>" />
 
<input type="submit" name="Submit" value="<?php _e('Save Changes') ?>" class="button" />
 
</form>

Easy.

Posted December 17, 2008 by Casey Bisson
Categories: Technology. Tags: compatibility, form validation, plugins, security, wordpress, WordPress 2.7.

6 Comments

Comments RSS TrackBack Identifier URI

User contributed tags for this post: