Is there anything special for dealing with $_POST
in this case?
Maybe, if you can elaborate more on what you mean by "special"?
But as with other PHP arrays, you should always check if the POST variable is actually set before attempting to use it:
// Example for the Edit_Email_1 input:
if ( isset( $_POST[\'Edit_Email_1\'] ) ) {
return $_POST[\'Edit_Email_1\'];
}
Secondly, you should also escape the value just as with any user-supplied or untrusted data, e.g. using esc_html()
or absint()
if the input should be a (non-negative) number, or esc_attr()
if the value is to be displayed in a form field like <input>
.
So for the above reason, you might want to add a context
attribute to your shortcode which will determine whether the value should be escaped, sanitized or returned as-is (i.e. raw/unchanged).
On the front end I am anticipating to use:
[Edit_Field Field="Email_1"]
Yes, you can do so, but you should know that:
Shortcodes are case-sensitive, so you should:
Because you defined the shortcode as add_shortcode(\'Edit_field\', \'Edit_field\');
— note the first Edit_field
, where the f
is in lowercase.
WordPress converts the shortcode attributes (i.e. the attribute name) to lowercase, so the $Field
in your Edit_field()
function will be empty and you should use $field
instead along with \'field\' => \'\'
in your shortcode_atts()
array.
However, please just avoid using extract()
and use the $atts
instead to access the shortcode attributes:
Note: I\'ve applied the context
attribute in this function.
function Edit_field( $atts ) {
// Don\'t use extract().
$atts = shortcode_atts( array(
\'field\' => \'\',
\'context\' => \'view\',
), $atts );
if ( $atts[\'field\'] == \'Email_1\' && isset( $_POST[\'Edit_Email_1\'] ) ) {
return ( \'edit\' === $atts[\'context\'] ) ?
esc_attr( $_POST[\'Edit_Email_1\'] ) :
esc_html( $_POST[\'Edit_Email_1\'] );
}
if ( $atts[\'field\'] == \'Client_Description\' && isset( $_POST[\'Edit_Client_Description\'] ) ) {
return ( \'edit\' === $atts[\'context\'] ) ?
esc_attr( $_POST[\'Edit_Client_Description\'] ) :
esc_html( $_POST[\'Edit_Client_Description\'] );
}
// Shortcodes should always return something.
return \'\'; // .. even if it\'s an empty string.
}
And because the attribute names are lowercased, then just use lowercase in the shortcode like so:
<p>[Edit_field field="Email_1"]</p>
<p>[Edit_field field="Client_Description"]</p>
<input value=\'[Edit_field field="Email_1" context="edit"]\'>
<input value=\'[Edit_field field="Client_Description" context="edit"]\'>