WordPress Functions Every PHP Developer Should Know

WordPress provides a huge library of functions. You do not need to learn them all. Here are the groups that appear in almost every project.

Site information

index.php

PHP

<?php
echo is_string(home_url("/about/")) ? "URLs: ok\n" : "";
echo str_starts_with(home_url("/about/"), "http") ? "home_url returns a full URL\n" : "";
echo is_string(get_bloginfo("name")) ? "site name: ok" : "";

Output

OUTPUT

1
2
3

URLs: ok
home_url returns a full URL
site name: ok

Function	Returns
`home_url($path)`	The site’s public address
`site_url($path)`	The WordPress address
`admin_url($path)`	An admin page URL
`get_bloginfo("name")`	Site title (and many other fields)
`get_template_directory_uri()`	URL of the active theme folder
`plugin_dir_path(__FILE__)`	Filesystem path of your plugin folder
`plugins_url("a.js", __FILE__)`	URL of a plugin file

Options: site-wide settings

Options are key and value pairs stored in the database. Think of them as a persistent associative array.

index.php

PHP

<?php
$perPage = (int) get_option("myplugin_per_page", 10);   // with a default

update_option("myplugin_per_page", 20);
delete_option("myplugin_per_page");

Use a prefix (myplugin_) so names never clash with other plugins.

Posts and post meta

index.php

PHP

<?php
$posts = get_posts(["numberposts" => 5, "post_type" => "post"]);

$price = get_post_meta($post_id, "_price", true);   // true: a single value
update_post_meta($post_id, "_price", 49.99);

Transients: cached values

A transient is an option with an expiry time. Use it to cache slow things (an API call, a heavy query).

index.php

PHP

<?php
$data = get_transient("myplugin_weather");

if ($data === false) {
    $data = fetch_weather();                                   // slow
    set_transient("myplugin_weather", $data, 15 * MINUTE_IN_SECONDS);
}

This is the same idea as the file cache in Consuming APIs. WordPress also defines time constants: MINUTE_IN_SECONDS, HOUR_IN_SECONDS, DAY_IN_SECONDS.

index.php

PHP

1
2

<?php
echo HOUR_IN_SECONDS . " " . DAY_IN_SECONDS;

Output

OUTPUT

3600 86400

Users and permissions

index.php

PHP

<?php
echo is_user_logged_in() ? "logged in" : "not logged in (a visitor)";
echo "\n";
var_dump(current_user_can("manage_options"));

Output

OUTPUT

1
2

not logged in (a visitor)
bool(false)

current_user_can("edit_posts") checks a capability. Always check capabilities, not role names.

Sanitising and validating input

index.php

PHP

<?php
echo sanitize_text_field("  <b>Hello</b>   World \n") . "\n";
echo sanitize_email("Isha@Example.com") . "\n";
echo sanitize_title("Hello World! It's PHP") . "\n";
echo absint("-42") . "\n";
var_dump(is_email("not-an-email"));

Output

OUTPUT

Hello World
Isha@Example.com
hello-world-its-php
42
bool(false)

Function	Cleans
`sanitize_text_field()`	A single line of text
`sanitize_textarea_field()`	Multi-line text
`sanitize_email()`	An email address
`sanitize_key()` / `sanitize_title()`	Keys and slugs
`absint()`	A non-negative integer
`esc_url_raw()`	A URL for storing
`wp_kses_post()`	Post HTML, allowing safe tags only

Talking to other sites: the HTTP API

Use WordPress’s own functions, not cURL, in most plugin code. They respect settings and give consistent errors.

index.php

PHP

<?php
$response = wp_remote_get("https://api.example.com/data", ["timeout" => 5]);

if (is_wp_error($response)) {
    error_log($response->get_error_message());
    return;
}

$status = wp_remote_retrieve_response_code($response);
$data = json_decode(wp_remote_retrieve_body($response), true);

wp_remote_post(), wp_remote_request() work the same way. is_wp_error() is how WordPress reports failures: functions return a WP_Error object instead of throwing exceptions.

index.php

PHP

<?php
$error = new WP_Error("not_found", "Item not found");

var_dump(is_wp_error($error));
echo $error->get_error_code() . ": " . $error->get_error_message();

Output

OUTPUT

1
2

bool(true)
not_found: Item not found

JSON helpers

wp_json_encode() is a safer json_encode(). wp_send_json_success() and wp_send_json_error() send a JSON response and stop.

Database: $wpdb

index.php

PHP

<?php
global $wpdb;

$row = $wpdb->get_row(
    $wpdb->prepare("SELECT ID, post_title FROM {$wpdb->posts} WHERE ID = %d", $id)
);

Always use $wpdb->prepare() for values. %d is an integer, %s a string, %f a float.

index.php

PHP

<?php
global $wpdb;

$sql = $wpdb->prepare("SELECT * FROM test WHERE name = %s AND qty = %d", "O'Reilly", 5);

echo str_contains($sql, "'O\\'Reilly'") || str_contains($sql, "O\\'Reilly") ? "quote escaped" : $sql;

Output

OUTPUT

quote escaped

Find a function

The official Developer Resources at developer.wordpress.org/reference list every function with parameters, return values and examples. Search there first.

lightbulb

Prefix everything you write

WordPress has one global function namespace. Name your functions myplugin_something(), or use a PHP namespace or a class, so they never clash with core or other plugins.