I’m here at WordCamp Seattle, and wanted to post my slides and a few other notes. I’m giving two talks today, one in the development track on best practices for plugin development (“Y U NO CODE WELL”), and an Ignite talk on contributing to the WordPress community.
First, during my development talk, I was asked for five tips on writing secure code. In return, I pulled up a recent email I wrote where I provided 10 tips:
Never trust the user. You need to assume that all user input is insecure, and that all output is unescaped. The primary points are:
- Always escape attributes, URLs, and text on output.
- Always sanitize, scrub and validate input.
- Always prepare database queries.
- Never trust the user.
- Never output anything that is unsanitized or unescaped.
- Never store anything that is unsanitized.
- Know the difference between authority and intention.
- Never trust the user.
- Always use the many helper functions — we make it easy to write secure code.
- Never trust the user.
Best Practices for Plugin Development
http://www.slideshare.net/andrewnacin/best-practices-in-plugin-development-wordcamp-seattle
Ignite Talk: Ask Not What WordPress Can Do For You
http://www.slideshare.net/andrewnacin/ask-not-what-wordpress-can-do-for-you-ignite-wordcamp-seattle