User Contributed Notes

1. Skip to note 3 content

   
   Benjamin Intal
   
   
   9 years ago
   

   You must log in to vote on the helpfulness of this noteVote results for this note: 8You must log in to vote on the helpfulness of this note

   Note that wp_nonce_url escapes & to & and may cause links or redirects to become incorrect.

   // Sample URL, note the & in there
   $url = 'http://localhost/?arg1=value1&arg2;=value2';
   
   // This will show <a href="http://localhost/?arg1=value1&amp;arg2=value2&amp;_wpnonce=abcdef" rel="nofollow ugc">http://localhost/?arg1=value1&amp;arg2=value2&amp;_wpnonce=abcdef</a>
   echo wp_nonce_url( $url, 'action' );
   
   // This will return <a href="http://localhost/?arg1=value1&arg2=value2&_wpnonce=abcdef" rel="nofollow ugc">http://localhost/?arg1=value1&arg2;=value2&_wpnonce=abcdef</a>
   echo add_query_arg( '_wpnonce', wp_create_nonce( 'action' ), $url );

2. Skip to note 4 content

   
   Codex
   
   
   10 years ago
   

   You must log in to vote on the helpfulness of this noteVote results for this note: 2You must log in to vote on the helpfulness of this note

   Example

   Plugin authors can safely add links that perform tasks using a combination of wp_nonce_url() and admin_url() .
   For instance, start by creating the link users can click to do something interesting:

   function my_plugin_do_something () {
   ?>
   
   
       <a href=""
           class="button button-primary">
       
   
   

   Then, to detect when the user clicks the link, check the nonce validity using wp_verify_nonce() in the function you defined when you called add_menu_page() or one of its Administration Menus wrappers. If the nonce isn’t valid, the link wasn’t clicked, so display the link. Otherwise, do “something interesting.”

   add_action('admin_menu', 'add_my_plugin_admin_screen');
   function add_my_plugin_admin_screen () {
       add_options_page(
           __('My Plugin Settings', 'my-plugin-textdomain'),
           __('My Plugin', 'my-plugin-textdomain'),
           'manage_options',
           'my_plugin_settings',
           'my_plugin_do_something'
       );
   }
   
   function my_plugin_do_something () {
       if (!isset($_GET['my_nonce']) || !wp_verify_nonce($_GET['my_nonce'], 'doing_something')) {
   ?>
   
   
       <a href=""
           class="button button-primary">
       
   
   

   Note that the recommended “context” parameter of the nonce is used to disambiguate which button was pressed. If you make more than one button users can press, make sure each button has a different nonce name and/or context.