wordpress-core

Sanitize all user input at entry points using functions like `sanitize_text_field()` or `sanitize_email()`, then escape output with `esc_html()`, `esc_attr()`, or `wp_kses_post()` before display. This prevents XSS and injection attacks in your plugin.

Hooks are extension points in WordPress code. Actions let you execute custom code at specific moments using `add_action()`, while filters modify data using `add_filter()`. Hooks let you extend functionality without editing core files, ensuring compatibility across updates.

Use `$wpdb->prepare()` with placeholders to build safe SQL queries, preventing SQL injection. Execute with `$wpdb->get_results()` or `$wpdb->insert()`. Prepared statements ensure data integrity and protect against malicious input.

Implement nonces for form submission verification, capability checks using `current_user_can()`, input sanitization, output escaping, and proper authentication headers. These prevent CSRF attacks, unauthorized access, and data exposure in admin and public contexts.

Create a main plugin file with required headers (Plugin Name, Version, Author), organize code into classes, use consistent naming (e.g., `my_plugin_function_name()`), and follow WordPress coding standards. Structure enables maintainability and prevents conflicts with other plugins.

No; use `$wpdb` for all database operations. It abstracts the database layer, handles table prefixes, applies security filters, and ensures compatibility across WordPress installations. Custom queries bypass these protections.