WordPress Quality Control & Assurance 2 — Questions and Answers
Question 1: Which WordPress function should you use to safely output user-supplied data in HTML attributes to prevent XSS?
- sanitize_text_field()
- esc_attr() (Correct answer)
- wp_kses()
- strip_tags()
Correct answer: esc_attr()
esc_attr() escapes special characters for safe use inside HTML attributes, preventing XSS attacks.
Question 2: When running PHPUnit tests for a WordPress plugin, which command runs only tests in a specific file?
- phpunit --filter FileName
- phpunit --file FileName
- phpunit tests/FileName.php (Correct answer)
- phpunit --only FileName
Correct answer: phpunit tests/FileName.php
Passing the file path directly to PHPUnit runs only the tests contained in that specific file.
Question 3: What is the purpose of the WordPress beta tester plugin?
- It enables debug logging automatically
- It allows switching to beta or nightly builds of WordPress core (Correct answer)
- It installs all available beta plugins from the repository
- It runs automated accessibility checks
Correct answer: It allows switching to beta or nightly builds of WordPress core
The WordPress Beta Tester plugin lets you opt into bleeding-edge or RC releases of WordPress core for testing.
Question 4: Which wp-config.php constant enables display of PHP errors on screen in WordPress?
- define('WP_DEBUG_LOG', true)
- define('WP_DEBUG_DISPLAY', true) (Correct answer)
- define('DISPLAY_ERRORS', true)
- define('WP_ERROR', true)
Correct answer: define('WP_DEBUG_DISPLAY', true)
WP_DEBUG_DISPLAY controls whether debug errors are printed to the screen (requires WP_DEBUG to also be true).
Question 5: During a WordPress theme QA review, you notice inline styles are being output via the_content(). What is the recommended fix?
- Use wp_kses_post() to strip disallowed tags (Correct answer)
- Replace the_content() with get_the_content()
- Add a content filter to remove styles
- Enable the DISALLOW_UNFILTERED_HTML constant
Correct answer: Use wp_kses_post() to strip disallowed tags
wp_kses_post() strips HTML tags and attributes not allowed in post content, including unwanted inline styles.
Question 6: What does the WP_MEMORY_LIMIT constant control in a WordPress installation?
- PHP memory limit for CLI scripts only
- Maximum memory WordPress can request from PHP (Correct answer)
- Total server RAM allocated to MySQL
- Memory cap for uploaded media files
Correct answer: Maximum memory WordPress can request from PHP
WP_MEMORY_LIMIT sets the maximum memory WordPress requests PHP to allocate for its processes.
Question 7: When performing QA on a WordPress REST API endpoint, which HTTP status code confirms a resource was successfully created?
- 200 OK
- 204 No Content
- 201 Created (Correct answer)
- 202 Accepted
Correct answer: 201 Created
HTTP 201 Created is the standard response code indicating a new resource was successfully created via a POST request.
WordPress Quality Control & Assurance 2
Which WordPress function should you use to safely output user-supplied data in HTML attributes to prevent XSS?