If you’re a WordPress developer who’s ever struggled with creating custom plugins from scratch, you know how time-consuming and tedious it can be. Even the smallest functionality requires hours of coding and testing to get right. And let’s face it, writing robust code that follows best practices is not exactly fun.
You’ll build a fully functional WordPress plugin using AI-generated code, automating the tedious tasks and freeing up your time for more important things. By the end of this tutorial, you’ll have successfully integrated an AI-generated feature to interact with users’ data, while also implementing security measures to prevent common pitfalls like SQL injection attacks.
Setting Up a Basic WordPress Plugin Structure
To get started with building our plugin, we need to set up a basic structure for it. This will involve creating a new directory for our plugin and setting up the necessary files.
First, let’s create a new directory in wp-content/plugins called ai-plugin. We’ll use this as the base directory for our plugin:
mkdir wp-content/plugins/ai-pluginNext, we need to set up the basic structure of our plugin. This includes creating several key files and directories that WordPress will recognize as a valid plugin.
Create a new file called plugin.php inside the ai-plugin directory:
<?php
/*
Plugin Name: AI Plugin
Description: A plugin built with AI-generated code
Version: 1.0
*/
// ai-plugin/plugin.php
if ( ! defined( 'ABSPATH' ) ) {
exit;
}
function ai_plugin_init() {
// This is where we'll add our plugin's logic later
}
add_action( 'plugins_loaded', 'ai_plugin_init' );This plugin.php file contains the basic metadata for our plugin, including its name and description. We’ve also defined a hook function ai_plugin_init() that will be triggered when WordPress loads.
Next, we need to create an empty directory called includes inside the ai-plugin directory:
mkdir wp-content/plugins/ai-plugin/includesThis is where we’ll store our plugin’s logic and functionality. In the next section, we’ll use an AI code generation tool to create some sample logic for our plugin.
Using an AI Code Generation Tool to Create Plugin Logic
In this section, we’ll leverage an AI code generation tool to create some of the plugin’s logic. I’ve used a combination of tools and techniques to generate some sample code for our plugin.
First, let’s use a simple example of generating a basic settings page using an AI coding assistant like GitHub Copilot, asking it for a settings page built on the WordPress Settings API. This will give us a starting point for implementing our plugin’s settings functionality. Here’s the generated code, saved as includes/class-ai-plugin-settings.php:
<?php
// includes/class-ai-plugin-settings.php
if ( ! defined( 'ABSPATH' ) ) {
exit;
}
class AI_Plugin_Settings {
public function __construct() {
add_action( 'admin_menu', array( $this, 'add_settings_page' ) );
add_action( 'admin_init', array( $this, 'register_settings' ) );
}
public function add_settings_page() {
add_options_page(
'AI Plugin Settings',
'AI Plugin',
'manage_options',
'ai-plugin-settings',
array( $this, 'render_settings_page' )
);
}
public function register_settings() {
// Update plugin settings here
register_setting( 'ai_plugin_settings', 'ai_plugin_setting', array(
'type' => 'string',
'sanitize_callback' => 'sanitize_text_field',
'default' => '',
) );
}
}Next, let’s create the view for our settings page. We’ll add a render_settings_page() method to the AI_Plugin_Settings class that outputs the form using WordPress’s Settings API helpers:
public function render_settings_page() {
if ( ! current_user_can( 'manage_options' ) ) {
return;
}
?>
<div class="wrap">
<h1>Settings</h1>
<form action="options.php" method="post">
<?php settings_fields( 'ai_plugin_settings' ); ?>
<label for="ai_plugin_setting">Setting:</label>
<input type="text" id="ai_plugin_setting" name="ai_plugin_setting"
value="<?php echo esc_attr( get_option( 'ai_plugin_setting' ) ); ?>" required>
<?php submit_button( 'Save Changes' ); ?>
</form>
</div>
<?php
}This generated code provides a solid foundation for our plugin’s settings functionality. WordPress’s options.php handles saving the form, checks the nonce created by settings_fields(), and runs our sanitize_text_field callback before storing the value. In the next section, we’ll integrate this AI-generated code into our existing plugin structure and continue building out the plugin’s features.
Integrating AI-Generated Code into the Plugin
Now that we have our AI-generated code ready, it’s time to integrate it into our WordPress plugin. Create a new file in the src/ directory of your plugin named Logic.php. This will be where we’ll put all our business logic.
<?php
// src/Logic.php
namespace AIPlugin;
class Logic {
public function __construct() {
// Initialize any necessary dependencies here.
}
public function generateReport(): array {
// This method will contain the AI-generated code for generating reports.
return [
'report' => 'This is a sample report generated by our plugin.',
'metadata' => ['name' => 'Sample Report', 'date' => date('Y-m-d H:i:s')]
];
}
}Next, create a Plugin class in src/Plugin.php that creates an instance of the Logic class and hooks it into WordPress.
<?php
// src/Plugin.php
namespace AIPlugin;
class Plugin {
public function __construct() {
add_action('init', [$this, 'init']);
}
public function init(): void {
$logic = new Logic();
// You can call the generateReport method here.
}
}Create a composer.json file in the root of your plugin (or update the existing one) with an autoload section for the newly created classes. PSR-4 autoloading requires each file name to match its class name, which is why the files are named Logic.php and Plugin.php.
{
"autoload": {
"psr-4": {
"AIPlugin\\": "src/"
}
}
}Run composer dump-autoload in your terminal to register the new classes with Composer. Then load the autoloader and start the plugin from plugin.php:
require_once __DIR__ . '/vendor/autoload.php';
require_once __DIR__ . '/includes/class-ai-plugin-settings.php';
new AIPlugin\Plugin();
if ( is_admin() ) {
new AI_Plugin_Settings();
}Now, your AI-generated code is integrated into the plugin and ready for testing.
With this approach, you can build out your plugin quickly, as long as you review and test the generated code before relying on it.
Security Considerations: Validating User Input and Preventing SQL Injection
Validating User Input and Preventing SQL Injection
When building a WordPress plugin that interacts with user input, security becomes paramount. One of the most critical concerns is preventing SQL injection attacks. To do this, we must ensure that all user input is properly sanitized before being used in database queries.
// Bad practice: directly inserting user input into a query
function ai_plugin_retrieve_data_unsafe( $input ) {
global $wpdb;
$query = "SELECT * FROM {$wpdb->prefix}ai_plugin_data WHERE name = '$input'";
return $wpdb->get_results( $query );
}
// Good practice: using prepared statements with placeholders
function ai_plugin_retrieve_data( $input ) {
global $wpdb;
$query = $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}ai_plugin_data WHERE name = %s", $input );
return $wpdb->get_results( $query );
}However, WordPress’s higher-level APIs, such as get_users(), WP_Query, $wpdb->insert() and $wpdb->update(), provide a more secure way to interact with the database. They escape the values you pass in for you, so we can avoid SQL injection vulnerabilities without writing raw SQL at all.
// Using a WordPress API that handles escaping for safe queries
function ai_plugin_find_users( $input ) {
return get_users( array(
'search' => $input,
'search_columns' => array( 'user_login' ),
) );
}Additionally, we should always sanitize and validate user input using WordPress’s sanitization functions together with plain PHP checks. This ensures that only expected and valid data is processed by the plugin.
// Validate user input before processing it
function ai_plugin_process_input( $input ) {
$name = sanitize_text_field( wp_unslash( $input ) );
if ( '' === $name || ! ctype_alpha( $name ) ) {
return new WP_Error( 'invalid_name', 'The name may only contain letters.' );
}
return $name;
}By following these best practices, we can significantly reduce the risk of SQL injection and ensure that our WordPress plugin is secure.
Testing and Debugging the Plugin with PHPUnit and Xdebug
Now that our plugin has been integrated with AI-generated code, it’s essential to ensure its stability and functionality. This involves thorough testing using PHPUnit and debugging with Xdebug.
Firstly, let’s set up a test environment for our plugin. In the root of our project, create a new directory called tests (if it doesn’t exist already). Then, run the following command to initialize a new PHPUnit test suite:
composer require --dev phpunit/phpunit:^9.5Next, we’ll write some tests for our plugin using PHPUnit. Create a new file in the tests/Unit directory called PluginTest.php. In this file, add the following code to test if our plugin’s core functionality is working as expected. We test the Logic class because it doesn’t depend on WordPress functions, so it can run without loading WordPress:
<?php
// tests/Unit/PluginTest.php
namespace Tests\Unit;
use PHPUnit\Framework\TestCase;
use AIPlugin\Logic; // Replace with your actual plugin namespace
class PluginTest extends TestCase
{
public function test_generate_report_returns_report_and_metadata()
{
$logic = new Logic();
$report = $logic->generateReport();
$this->assertArrayHasKey('report', $report);
$this->assertSame('Sample Report', $report['metadata']['name']);
}
}Run the following command to execute our tests:
vendor/bin/phpunit --bootstrap vendor/autoload.php --colors=always testsIf all tests pass, we can proceed with debugging using Xdebug. To enable Xdebug in PHP, modify your php.ini file (usually located in /etc/php/8.2/apache2/php.ini) and add the following lines at the end (this assumes the Xdebug 3 extension is already installed and loaded):
xdebug.mode = debug
xdebug.start_with_request = yesRestart your Apache server or run sudo service apache2 restart. Now, you can set breakpoints in your code using an IDE like PhpStorm with Xdebug support enabled.
Deploying the Plugin to WordPress.org for Distribution
Now that our plugin is complete and tested, it’s time to share it with the world by deploying it to WordPress.org. This involves creating a WordPress.org account, submitting your plugin for review, and configuring the repository settings.
First, create a WordPress.org account if you haven’t already: https://login.wordpress.org/register
Next, if you track your plugin with Git (see the next section for setting up the repository), navigate to your plugin’s directory in the terminal and commit any changes:
git add .
git commit -m "Finalize plugin for WordPress.org submission"Your plugin also needs a readme.txt file in the WordPress.org readme format. Create a new zip archive containing your plugin files by running composer install --no-dev --optimize-autoloader (so the production autoloader is included) and then zip -r ai-plugin.zip ai-plugin -x "*.git*" from the wp-content/plugins directory. Then, go to the Add Your Plugin page on WordPress.org and submit your plugin for review.
Once your plugin is approved, WordPress.org gives you a Subversion (SVN) repository for it. Check it out, copy your files into trunk, and commit:
svn co https://plugins.svn.wordpress.org/your-plugin-name
cp -r ai-plugin/* your-plugin-name/trunk/
cd your-plugin-name
svn add --force trunk
svn ci -m "Initial release" --username your-wordpress-org-usernameThis publishes your code to the plugin directory. Once your plugin is approved and live on WordPress.org, other developers can easily install and use it by searching for its name in the WordPress Plugin Directory.
After completing this step, our WordPress plugin is ready to be shared with the community!
Maintaining and Updating the Plugin using Git and Composer
Now that our plugin is live on WordPress.org, it’s essential to set up a system for maintaining and updating it efficiently. This involves version controlling our code with Git and managing dependencies with Composer.
First, initialize a new Git repository in the root of our plugin directory:
git init
git add .
git commit -m "Initial commit"Next, create a composer.json file to define our project’s dependencies:
{
"name": "example/ai-plugin",
"description": "A brief description of the plugin.",
"autoload": {
"psr-4": {
"AIPlugin\\": "src/"
}
},
"require-dev": {
"phpunit/phpunit": "^9.5"
}
}Install Composer dependencies and update the composer.lock file:
composer installTo keep our plugin up-to-date, we’ll create a new branch for each major release and use Composer to handle dependency updates. When updating dependencies, run composer update and commit the changes.
As our project grows, using version control and dependency management will save us time in the long run. With Git and Composer, we can maintain a clean, organized codebase that’s easy to update and distribute.
Frequently Asked Questions
What is the best AI code generation tool to use for building a WordPress plugin?
There are several AI code generation tools available, but some popular options include GitHub Copilot and Tabnine. You can experiment with different tools to find the one that works best for your specific needs.
How do I prevent SQL injection attacks when using AI-generated code in my WordPress plugin?
To prevent SQL injection attacks, make sure to sanitize user input and use prepared statements or parameterized queries. You can also implement security measures like authentication and authorization to restrict access to sensitive data.
Can I use a different programming language for building my WordPress plugin instead of PHP?
Not entirely. WordPress loads plugins as PHP, so every plugin needs at least a PHP main file with the plugin header. You can write parts of it in JavaScript, such as block editor blocks built with the @wordpress/scripts tooling or front-end code that talks to the WordPress REST API, and code in other languages like Python can only run as a separate service that your plugin calls. This may add additional complexity to your development process.
What if the AI-generated code contains errors or bugs?
If the AI-generated code contains errors or bugs, review the generated code carefully and test it thoroughly before deploying it in production. You can also use debugging tools like var_dump() or xdebug to identify and fix issues.
How does using an AI code generation tool affect my plugin’s performance?
Using an AI code generation tool can potentially improve your plugin’s performance by reducing the time spent on manual coding, but it may also introduce additional dependencies or overhead. Monitor your plugin’s performance and make adjustments as needed to optimize its execution.