PHP coding standards for Oh My Brand! theme. WordPress Coding Standards, strict typing, escaping, sanitization, DocBlocks, and security practices. Use when writing PHP functions, classes, or render templates.
PHP coding standards and security practices for the Oh My Brand! WordPress FSE theme.
render.php)helpers.php)| File | Purpose |
|---|---|
| file-structure.php | File and class structure |
| escaping-examples.php | Output escaping patterns |
| sanitization-examples.php |
| Input sanitization |
| nonce-examples.php | Nonce verification |
| hooks-examples.php | Actions and filters |
Every PHP file must include:
<?php
/**
* Short description of the file.
*
* @package theme-oh-my-brand
*/
declare(strict_types=1);
See file-structure.php for complete structure.
| Type | Convention | Example |
|---|---|---|
| Classes | PascalCase | GalleryBlock |
| Functions | snake_case with prefix | omb_get_gallery_images() |
| Methods | snake_case | get_images() |
| Variables | snake_case | $gallery_images |
| Constants | SCREAMING_SNAKE | OMB_VERSION |
| Files | kebab-case | gallery-block.php |
Use omb_ prefix for theme functions:
// ✅ Good - prefixed
function omb_register_blocks(): void { }
// ❌ Bad - no prefix
function register_blocks(): void { }
Use type hints for all function parameters and return types:
function format_gallery_images(array $images, int $limit = 10): array {
// Implementation
}
| Type | Usage |
|---|---|
string | Text values |
int | Integer numbers |
float | Decimal numbers |
bool | Boolean values |
array | Arrays (use PHPDoc for element types) |
?string | Nullable string |
void | No return value |
All output must be escaped based on context:
| Function | Use Case |
|---|---|
esc_html() | Text content |
esc_attr() | HTML attributes |
esc_url() | URLs |
wp_kses_post() | Rich HTML content |
wp_json_encode() | JavaScript values |
esc_html__() | Translated text |
esc_attr__() | Translated attributes |
See escaping-examples.php for examples.
Sanitize all input data before use:
| Function | Use Case |
|---|---|
sanitize_text_field() | Text input |
sanitize_textarea_field() | Textarea |
sanitize_email() | |
absint() | Integer |
esc_url_raw() | URL for database |
sanitize_file_name() | File name |
sanitize_html_class() | HTML class |
See sanitization-examples.php for examples.
Use nonces for form submissions and AJAX:
| Function | Purpose |
|---|---|
wp_nonce_field() | Add nonce to form |
wp_create_nonce() | Create nonce for AJAX |
wp_verify_nonce() | Verify form nonce |
check_ajax_referer() | Verify AJAX nonce |
See nonce-examples.php for examples.
| Hook Type | Function | Custom Hook |
|---|---|---|
| Actions | add_action() | do_action() |
| Filters | add_filter() | apply_filters() |
add_action('init', 'omb_register_blocks');
add_action('wp_enqueue_scripts', 'omb_enqueue_assets');
add_action('after_setup_theme', 'omb_setup_theme');
add_action('init', 'omb_early_init', 5); // Earlier
add_action('init', 'omb_normal_init'); // Default: 10
add_action('init', 'omb_late_init', 20); // Later
See hooks-examples.php for examples.
Use early returns and guard clauses:
function omb_get_gallery_html(int $gallery_id): string {
if ($gallery_id <= 0) {
return '';
}
$gallery = get_post($gallery_id);
if (!$gallery instanceof WP_Post) {
return '';
}
return omb_render_gallery($gallery);
}