All posts in this stream, newest first.
Two lines of code, a nonce check and a capability check, close most of the privilege escalation and cross-site request forgery holes found in custom WordPress plugins and themes. Here is how to use them correctly, every time.
A practical look at how custom database queries become SQL injection holes in WordPress plugins and themes, and the prepare pattern and review habits that stop them before launch.
A child theme lets you customize colors, layouts, and functions safely, so the next parent theme update doesn't erase your work. Here's the full setup in about ten minutes.
