WordPress WordPress Plugin Architecture & Configuration 2 — Questions and Answers
Question 1: What is the correct way to handle AJAX requests securely in WordPress plugins?
- Use wp_ajax_ and wp_ajax_nopriv_ hooks with nonce verification (Correct answer)
- Use $_POST directly in functions.php
- Create a custom PHP endpoint file
- Use jQuery $.get without authentication
Correct answer: Use wp_ajax_ and wp_ajax_nopriv_ hooks with nonce verification
WordPress provides wp_ajax_ (for logged-in users) and wp_ajax_nopriv_ hooks plus nonces to handle AJAX securely.
Question 2: What does sanitize_text_field() do in WordPress plugin development?
- Removes unsafe characters and extra whitespace from text input (Correct answer)
- Escapes HTML for output
- Validates email format
- Encodes special characters for URLs
Correct answer: Removes unsafe characters and extra whitespace from text input
sanitize_text_field() strips HTML tags, removes extra whitespace, and cleans potentially unsafe characters from user input.
Question 3: Which WordPress function should you use to safely output user-generated content in HTML?
- esc_html() (Correct answer)
- sanitize_text_field()
- wp_kses()
- htmlspecialchars()
Correct answer: esc_html()
esc_html() encodes HTML special characters to prevent XSS when outputting text inside HTML elements.
Question 4: What is the purpose of the WordPress Settings API in plugin development?
- To create secure, standardized plugin settings pages integrated with WordPress admin (Correct answer)
- To access the WordPress REST API
- To store theme customizer settings
- To register custom taxonomies
Correct answer: To create secure, standardized plugin settings pages integrated with WordPress admin
The Settings API provides functions like register_setting() and add_settings_field() to build plugin options pages safely and consistently.
Question 5: In WordPress, what does wp_die() do inside a plugin's AJAX handler?
- Terminates script execution and outputs a response (Correct answer)
- Deletes the current post
- Uninstalls the plugin
- Logs an error to debug.log
Correct answer: Terminates script execution and outputs a response
wp_die() ends AJAX handler execution cleanly and outputs the response, which is required to prevent extra output from being sent.
Question 6: What WordPress function creates a custom database table for a plugin?
- dbDelta() (Correct answer)
- wpdb->create_table()
- register_table()
- wp_create_table()
Correct answer: dbDelta()
dbDelta() compares the desired table structure with the existing schema and applies only the necessary changes.
WordPress WordPress Plugin Architecture & Configuration 2
What is the correct way to handle AJAX requests securely in WordPress plugins?