I’m here at WordCamp Seattle, and wanted to post my slides and a few other notes. I’m giving two talks today, one in the development track on best practices for plugin development (“Y U NO CODE WELL”), and an Ignite talk on contributing to the WordPress community.
First, during my development talk, I was asked for five tips on writing secure code. In return, I pulled up a recent email I wrote where I provided 10 tips:
Never trust the user. You need to assume that all user input is insecure, and that all output is unescaped. The primary points are:
- Always escape attributes, URLs, and text on output.
- Always sanitize, scrub and validate input.
- Always prepare database queries.
- Never trust the user.
- Never output anything that is unsanitized or unescaped.
- Never store anything that is unsanitized.
- Know the difference between authority and intention.
- Never trust the user.
- Always use the many helper functions — we make it easy to write secure code.
- Never trust the user.
Best Practices for Plugin Development
http://www.slideshare.net/andrewnacin/best-practices-in-plugin-development-wordcamp-seattle
Ignite Talk: Ask Not What WordPress Can Do For You
http://www.slideshare.net/andrewnacin/ask-not-what-wordpress-can-do-for-you-ignite-wordcamp-seattle
I also plan to hold an unconference session on contributing to WordPress. I have it
On Saturday, October 30, I was asked to present what’s next for WordPress at
On Saturday, Sept. 11, I’ll be speaking at
On September 18, while all the cool kids are attending WordCamp Portland, I’ll be traversing only one timezone to