Testing your plugins

We've tried out our new plugin, so it's probably a good moment to say a word or two about testing your plugins and making sure that they don't cause any problems for regular users in general.

Our particular plugin is a very simple one; the only thing it does is process each link it finds inside any post or page's content, and adds a custom icon next to it. However, even such a simple plugin can be a possible security breach point. For example, the only place where the user can input anything is the plugins section in wp-admin (the field handling the supported file types). Now, there is a possibility that someone might use this field to input a piece of specific PHP code instead of a standard file type; for instance, code that is meant to perform a specific action on the server side, and which could result in a serious security breach. That is why our update_supportedtypes_options() function has the following two lines:

$safe_val = addslashes(strip_tags($_POST
   ['doctype_styles_new_supportedtypes'])); 
update_option('doctype_styles_new_supportedtypes', $safe_val);

Thanks to them, everything that the user inputs will have all of the PHP and HTML tags stripped by strip_tags(), and then every character that needs to be quoted in database queries will be handled by addslashes(). Using such functions is a just-in-case practice, but it tends to be something that eventually pays off.

Apart from testing our work against some of the common hacking practices, such as code injection or SQL injection, we also need to handle all kinds of unconventional uses we can think of. For instance, would anything bad happen if someone put a value that's not a standard file type? Or, what if the CSS file goes missing all of a sudden? These are just some of the questions a good testing session should answer.

Another good way of testing plugins is to hand them over to a few trusted users and ask for feedback. Someone who's entirely new to your plugin will usually do a way better job of testing it than you, the author.

Of course, this short section here only scratches the surface of plugin testing and code testing in general, so I encourage you to give it a closer look on your own. There are many great resources on the web and in your nearest bookstore.