WordPress Coding Standards

https://github.com/wordpress/wordpress-coding-standards
Admin
A collection of PHP_CodeSniffer rules to validate code developed for WordPress, ensuring code...
Tokens:74,326
Snippets:511
Trust Score:9
License:MIT
Update:2 days ago
Show doc for...
Tokens:
Raw
### Install PEAR in XAMPP

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/How-to-use-WordPressCS-with-Eclipse-and-XAMPP

Run the go-pear.phar file locally in the XAMPP PHP directory to install PEAR. Choose 'locally' when prompted for installation type.

```bash
C:\xampp\php>php go-pear.phar
```

--------------------------------

### Attempt to install PHP_CodeSniffer via PEAR (fails)

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/How-to-use-WordPressCS-with-Eclipse-and-XAMPP

First attempt to install PHP_CodeSniffer with --alldeps. Fails because no releases are available, indicating a cache issue.

```bash
C:\xampp\php>pear install --alldeps PHP_CodeSniffer

No releases available for package "pear.php.net/PHP_CodeSniffer"
install failed
```

--------------------------------

### Travis CI configuration to run PHPCS with WordPress standards

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Running-in-Travis

Add this YAML to your .travis.yml file. It sets up a PHP 8.1 job with SNIFF=1, installs dependencies via Composer, and runs vendor/bin/phpcs -p . --standard=WordPress. Use a matrix setup to run PHPCS only once by setting the SNIFF environment variable.

```yaml
language: php

jobs:
  include:
    # Arbitrary PHP version to run the sniffs against.
    - php: 8.1
      env: SNIFF=1

cache:
  directories:
    - $HOME/.composer/cache

before_install:
  # Turn off Xdebug for performance reasons.
  - phpenv config-rm xdebug.ini || echo 'No xdebug config.'

install:
  # Install WordPressCS via Composer.
  - if [[ "$SNIFF" == "1" ]]; then travis_retry composer install --no-interaction; fi
  - if [[ "$SNIFF" == "1" ]]; then phpenv rehash; fi

script:
  # Run against WordPress Coding Standards.
  # You can use any of the normal PHPCS command line arguments in the command:
  # https://github.com/squizlabs/PHP_CodeSniffer/wiki/Usage
  - if [[ "$SNIFF" == "1" ]]; then vendor/bin/phpcs -p . --standard=WordPress; fi
```

--------------------------------

### Install PHP_CodeSniffer via PEAR (successful)

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/How-to-use-WordPressCS-with-Eclipse-and-XAMPP

Second attempt to install PHP_CodeSniffer after clearing cache. Succeeds, downloading version 1.5.5, but warns about outdated channel protocols.

```bash
C:\xampp\php>pear install --alldeps PHP_CodeSniffer

WARNING: channel "pear.php.net" has updated its protocols, use "pear channel-update pear.php.net" to update
Package "pear.php.net/PHP_CodeSniffer" dependency "pear.phpunit.de/PHP_Timer" has no releases
downloading PHP_CodeSniffer-1.5.5.tgz ...
Starting to download PHP_CodeSniffer-1.5.5.tgz (412,025 bytes)
................................................................done: 412,025 bytes
install ok: channel://pear.php.net/PHP_CodeSniffer-1.5.5
```

--------------------------------

### Running PHPCS with WordPress Standard

Source: https://github.com/wordpress/wordpress-coding-standards/blob/develop/README.md

Commands to run PHPCS using the WordPress standard after installation. The project local install uses vendor/bin/phpcs, while the global install uses the path in %USER_DIRECTORY%/Composer/vendor/bin. The -ps flags scan the current directory and show progress and sniff names.

```bash
# Project local install
vendor/bin/phpcs -ps . --standard=WordPress

# Global install
%USER_DIRECTORY%/Composer/vendor/bin/phpcs -ps . --standard=WordPress
```

--------------------------------

### Composer Project-based Installation

Source: https://github.com/wordpress/wordpress-coding-standards/blob/develop/README.md

Run these commands from the root of your project to install WordPressCS as a dev dependency. The first command allows the Composer PHPCS plugin, and the second requires the wp-coding-standards/wpcs package version ^3.0.

```bash
composer config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
composer require --dev wp-coding-standards/wpcs:"^3.0"
```

--------------------------------

### Composer Global Installation

Source: https://github.com/wordpress/wordpress-coding-standards/blob/develop/README.md

Use these commands to install WordPressCS globally via Composer. The first command allows the Composer PHPCS plugin globally, and the second requires the wp-coding-standards/wpcs package version ^3.0 globally.

```bash
composer global config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
composer global require --dev wp-coding-standards/wpcs:"^3.0"
```

--------------------------------

### Add custom cache functions for DirectDatabaseQuery

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Registers custom wrapper functions that handle caching of database queries, so the WordPress.DB.DirectDatabaseQuery sniff recognizes them as cachable. The example defines get, set, and delete functions.

```xml
<rule ref="WordPress.DB.DirectDatabaseQuery">
	<properties>
		<property name="customCacheGetFunctions" type="array">
			<element value="prefix_get_from_db_and_cache"/>
			<element value="prefix_also_get_from_db_and_cache"/>
		</property>
		<property name="customCacheSetFunctions" type="array">
			<element value="prefix_get_from_db_and_cache"/>
		</property>
		<property name="customCacheDeleteFunctions" type="array">
			<element value="prefix_remove_from_db_cache"/>
		</property>
	</properties>
</rule>
```

--------------------------------

### Example of using switch in callback() for different groups

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Upgrade-Guide-to-WordPressCS-3.0.0-for-Developers-of-external-standards

Shows how to implement different logic per group in the callback() method of a sniff extending AbstractArrayAssignmentRestrictionsSniff, since the 'callback' key is no longer supported.

```php
public function callback( $key, $val, $line, $group ) {
    switch( $group ) {
        case 'groupA':
            return $this->callback_for_group_A($key, val, $line);
        case 'groupB':
            return $this->callback_for_group_B($key, val, $line);
    }
}
```

--------------------------------

### Upgrade WordPressCS in a Composer global install

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Upgrade-Guide-to-WordPressCS-3.0.0-for-ruleset-maintainers

Run these commands to upgrade WordPressCS to ^3.0.0 in a global Composer install. The commands mirror the project-based upgrade but use the global scope.

```bash
composer global remove --dev dealerdirect/phpcodesniffer-composer-installer higidi/composer-phpcodesniffer-standards-plugin squizlabs/PHP_codesniffer
composer global config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
composer global require --dev wp-coding-standards/wpcs:"^3.0.0" --update-with-dependencies
```

--------------------------------

### List installed coding standards

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/How-to-use-WordPressCS-with-Eclipse-and-XAMPP

Check which coding standards are installed in PHP CodeSniffer. Initially shows MySource, PEAR, PHPCS, PSR1, PSR2, Squiz, and Zend.

```bash
C:\xampp\php>phpcs -i

The installed coding standards are MySource, PEAR, PHPCS, PSR1, PSR2, Squiz and Zend
```

--------------------------------

### Clear PEAR cache

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/How-to-use-WordPressCS-with-Eclipse-and-XAMPP

Clear the PEAR cache to resolve the installation failure. Output shows the cache directory and number of entries cleared.

```bash
C:\xampp\php>pear clear-cache

reading directory C:\Users\user\AppData\Local\Temp\pear\cache
10 cache entries cleared
```

--------------------------------

### Run phpcs with WordPress standard on a file

Source: https://github.com/wordpress/wordpress-coding-standards/blob/develop/README.md

Use this command to check a file or directory against the WordPress coding standards. The example checks wp-load.php and produces a report of errors and warnings.

```bash
vendor/bin/phpcs --standard=WordPress wp-load.php
```

--------------------------------

### Example of custom test class that will not be recognized

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

This PHP example shows a test class extending a custom test case imported via a `use` statement. The sniff will not recognize it because the class name is not `TestCase`.

```php
use My\Plugin\Integrations\MyTestCase;

class MySpecificTest extends MyTestCase {
```

--------------------------------

### Example of array with mixed data types

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Sanitizing-array-input-data

Shows an array with a boolean-like string and a nested array, used to illustrate sanitizing smaller parts separately.

```php
$_POST['data'] = array(
    'bool' => '0',
    'array' => array(
         0 => 'one',
         1 => 'two',
     )
);
```

--------------------------------

### Example of custom test class that will not be recognized due to namespace

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

This PHP example shows a test class extending a custom test case imported via a `use` statement. The sniff will not recognize it because the class is in a namespace and the imported class is not named `TestCase`.

```php
namespace Foo;
use My\Plugin\Integrations\TestCase;

class MySpecificTest extends TestCase {
```

--------------------------------

### Correct way to extend a custom test class

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

This PHP example shows the correct way to extend a custom test class by using the fully qualified class name. This will be recognized by the sniff.

```php
class MySpecificTest extends My\Plugin\Integrations\TestCase {
```

--------------------------------

### Initial wp_die() call with WP_Error

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Escaping-a-WP_Error-object

Example that triggers the WordPressCS error 'Expected next thing to be an escaping function, not $foo'.

```php
if ( is_wp_error( $foo ) ) {
    wp_die( $foo );
}
```

--------------------------------

### Example of array with assignment operator on new line

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Shows an array definition where the double arrow is on a new line to avoid long lines. This style is allowed by default.

```php
$array = array(
    'really_long_array_key'
        => 'an even longer value........................................................',
);
```

--------------------------------

### GitHub Actions workflow for PHPCS check

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Running-in-GitHub-Actions

This YAML workflow triggers on push, pull request, and manual dispatch. It sets up PHP, installs Composer dependencies, runs PHPCS with a checkstyle report, and uses cs2pr to show results in pull requests. Requires a .phpcs.xml[.dist] file in the project root, or add --standard=path/to/yourrulesetfile.xml to the PHPCS command.

```yaml
name: PHPCS check
on:
  push:
  pull_request:
  # Allow manually triggering the workflow.
  workflow_dispatch:

# Cancel all previous workflow runs for the same branch that have not yet completed.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  phpcs:
    name: PHPCS check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: "shivammathur/setup-php@v2"
        with:
          php-version: 'latest'
          ini-values: 'memory_limit=1G'
          coverage: none
          tools: cs2pr

      - name: Install Composer dependencies
        uses: "ramsey/composer-install@v3"
        with:
          # Bust the cache at least once a month - output format: YYYY-MM.
          custom-cache-suffix: $(date -u "+%Y-%m")

      - name: Run PHPCS checks
        id: phpcs
        run: vendor/bin/phpcs --report-full --report-checkstyle=./phpcs-report.xml

      - name: Show PHPCS results in PR
        if: ${{ always() && steps.phpcs.outcome == 'failure' }}
        run: cs2pr ./phpcs-report.xml
```

--------------------------------

### Example of multi-dimensional $_POST array

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Sanitizing-array-input-data

Shows a multi-dimensional array structure that triggers the WordPressCS error when accessed without proper sanitization.

```php
$_POST['announcement']['display'] = array (
    'verticals' => 
        array (
            0 => 'life',
            1 => 'politics',
    ),
);
```

--------------------------------

### Namespace change: Old use statement

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Upgrade-Guide-to-WordPressCS-2.0.0-for-Developers-of-external-standards

The old namespace for WordPressCS sniffs was WordPress. This example shows the previous use statement that needs to be updated.

```php
use WordPress\Sniff;

class MyCustomSniff extends Sniff {}
```

--------------------------------

### Good and bad examples of space before colon in alternative syntax

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Shows the correct and incorrect usage of a space before the colon in alternative syntax control structures. The space is required by default.

```php
// Good:
<php if ( isset( $foo ) ) : ?>
Foo!
<?php endif; ?>
```

```php
// Bad:
<php if ( isset( $foo ) ): ?>
Foo!
<?php endif; ?>
```

--------------------------------

### Refactor to avoid ignore annotation

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Ignoring-Parts-of-a-File

A refactored version of the earlier example that outputs directly inside the function, satisfying WordPressCS without needing an ignore comment.

```php
function some_html() {
    echo '<strong>bar</strong>';
}
```

--------------------------------

### Using wp_unslash() on $_POST input (after fix)

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Fixing-errors-for-input-data

Corrected example that wraps $_POST['foo'] with wp_unslash() to remove WordPress's magic-quote slashes before using the data.

```php
if ( isset( $_POST['foo'] ) ) {
    $foo = wp_unslash( $_POST['foo'] ); // ...
```

--------------------------------

### PHP array alignment example for exact property

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Shows an array with keys of varying lengths. With 'exact' set to true, the arrows align to the longest key plus one space; with false, the alignment is more lenient and removing the longest key does not require realignment.

```php
/*
 * With `exact` set to `true`, this array would be fixed to align at the end
 * of `even_longer_key` + 1 space.
 * With `exact` set to `false`, the below would be accepted as a valid alignment.
 *
 * And with `exact` set to `false`, taking the `even_longer_key` array item
 * out of the array would not impact the alignment, while with `exact` set
 * to `true`, the assignment operators for the whole array would need
 * to be re-aligned.
 */
$array = array(
    'short_key'         => 'value',
    'longer_key'        => 'value',
    'even_longer_key'   => 'value',
);
```

--------------------------------

### Configure customAllowedFunctionsList property for NoSilencedErrors sniff

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Defines a custom list of function names for which the error control operator will not trigger a warning. In this example, 'unlink' and 'preg_match' are allowed.

```xml
<rule ref="WordPress.PHP.NoSilencedErrors">
	<properties>
		<property name="customAllowedFunctionsList" type="array">
			<element value="unlink"/>
			<element value="preg_match"/>
		</property>
	</properties>
</rule>
```

--------------------------------

### Upgrade WordPressCS in a Composer project-based install

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Upgrade-Guide-to-WordPressCS-3.0.0-for-ruleset-maintainers

Run these commands to upgrade WordPressCS to ^3.0.0 in a Composer project. First remove the old PHPCS Composer plugins and PHP_CodeSniffer, then allow the dealerdirect plugin, and finally require the new version with dependencies.

```bash
composer remove --dev dealerdirect/phpcodesniffer-composer-installer higidi/composer-phpcodesniffer-standards-plugin squizlabs/PHP_codesniffer
composer config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
composer require --dev wp-coding-standards/wpcs:"^3.0.0" --update-with-dependencies
```

--------------------------------

### Example of code triggering the undefined superglobal index error

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Fixing-errors-for-input-data

This code accesses $_POST['auth_step'] without checking if the key exists, which triggers the WordPress coding standards error about a possibly undefined superglobal array index.

```php
if ( 'Yes' === $_POST['auth_step'] ) { // ...
```

--------------------------------

### Example of validation scope behavior with check_validation_in_scope_only

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

PHP code illustrating how the sniff treats input validation depending on the property value. When false, validation outside the scope is accepted; when true, only in-scope validation is considered valid.

```php
// When `check_validation_in_scope_only` is `false`, this is considered valid:
if ( ! isset( $_GET['post_id'] ) ) {
	// Do stuff, like maybe return or exit (but could be anything)
}

foo( $_GET['post_id'] );

// When `check_validation_in_scope_only` is `true`, the above would be invalid.
// In that case, the variable will only be considered validated if used within
// the scope of the validating condition, like this:
if ( isset( $var ) ) {
	foo( $var );
}
```

--------------------------------

### Enable blank line check for WordPress.WhiteSpace.ControlStructureSpacing

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Turns on the `blank_line_check` property to check for and fix stray blank lines at the start and end of control structures. This check is off by default; set the property to `true` to enable it.

```xml
<rule ref="WordPress.WhiteSpace.ControlStructureSpacing">
	<properties>
		<property name="blank_line_check" value="true"/>
	</properties>
</rule>
```

--------------------------------

### Updating WordPressCS to a Newer Version

Source: https://github.com/wordpress/wordpress-coding-standards/blob/develop/README.md

Commands to upgrade WordPressCS to a newer version, depending on whether it was installed locally or globally. Use the project local install command from your project root, or the global install command for a global installation.

```bash
# Project local install
composer update wp-coding-standards/wpcs --with-dependencies

# Global install
composer global update wp-coding-standards/wpcs --with-dependencies
```

--------------------------------

### Set prefixes from command line using --runtime-set

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Use --runtime-set prefixes with a comma-delimited list without spaces to set the property from the command line.

```bash
phpcs -p . --standard=WordPress --runtime-set prefixes my_prefix,tgmpa
```

--------------------------------

### Configure installed_paths for WordPress standards

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/How-to-use-WordPressCS-with-Eclipse-and-XAMPP

Set the installed_paths configuration so phpcs can detect the WordPress standards. The path points to the cloned repository.

```bash
C:\xampp\php>phpcs --config-set installed_paths c:\xampp\php\pear\PHP\CodeSniffer\Standards\WordPress-Coding-Standards
```

--------------------------------

### Upgrade all PEAR packages

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/How-to-use-WordPressCS-with-Eclipse-and-XAMPP

Upgrade all PEAR packages to ensure everything is up to date.

```bash
C:\xampp\php>pear upgrade-all
```

--------------------------------

### Set text_domain from command line using --runtime-set

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Use --runtime-set text_domain with a comma-delimited list without spaces to set the property from the command line. Available since WordPressCS 0.11.0+.

```bash
phpcs -p . --standard=WordPress --runtime-set text_domain my-slug,default
```

--------------------------------

### Set minimum_wp_version from command line with phpcs

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Uses the --runtime-set flag to set minimum_wp_version to 4.5 for all sniffs when running phpcs with the WordPress standard.

```bash
phpcs . --standard=WordPress --runtime-set minimum_wp_version 4.5
```

--------------------------------

### Navigate to CodeSniffer standards directory

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/How-to-use-WordPressCS-with-Eclipse-and-XAMPP

Change to the directory where CodeSniffer standards are stored.

```bash
C:\xampp\php>cd pear\PHP\CodeSniffer\Standards
```

--------------------------------

### Removed property: Old use of $phpcsCommentTokens

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Upgrade-Guide-to-WordPressCS-2.0.0-for-Developers-of-external-standards

The old property used the 'type' array key. This example shows the previous usage that must be updated.

```php
use WordPress\Sniff;

class MyCustomSniff extends Sniff {
	public function process_token( $stackPtr ) {
		if ( isset( $this->phpcsCommentTokens[ $this->tokens[ $stackPtr ]['type'] ] ) ) {
			// Do something.
		}
	}
}
```

--------------------------------

### Configure custom sanitization functions for Security.ValidatedSanitizedInput and Security.NonceVerification

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

XML ruleset configuration to add custom sanitizing and unslashing functions for both sniffs. Use the same function lists for both properties to ensure consistent behavior.

```xml
<rule ref="WordPress.Security.ValidatedSanitizedInput">
	<properties>
		<property name="customSanitizingFunctions" type="array">
			<element value="prefix_sanitize_url"/>
			<element value="prefix_sanitize_postal_code"/>
		</property>
		<property name="customUnslashingSanitizingFunctions" type="array">
			<element value="prefix_sanitize_unslash_url"/>
		</property>
	</properties>
</rule>

<rule ref="WordPress.Security.NonceVerification">
	<properties>
		<property name="customSanitizingFunctions" type="array">
			<element value="prefix_sanitize_url"/>
			<element value="prefix_sanitize_postal_code"/>
		</property>
		<property name="customUnslashingSanitizingFunctions" type="array">
			<element value="prefix_sanitize_unslash_url"/>
		</property>
	</properties>
</rule>
```

--------------------------------

### Expected folder structure for PHPCS GitHub Actions

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Running-in-GitHub-Actions

This tree shows the required folder layout for the workflow to work out-of-the-box. It includes the .github/workflows/phpcs.yml file, the vendor/bin/phpcs binary, and the PHPCS configuration file [.]phpcs.xml[.dist].

```text
./project-root
├── .github
│   └── workflows
│       └── phpcs.yml
├── vendor
│   └── bin
│       └── phpcs
└── [.]phpcs.xml[.dist]  # PHPCS configuration file
```

--------------------------------

### Accessing $_POST without unslashing (before fix)

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Fixing-errors-for-input-data

Example that triggers the WordPressCS error 'Missing wp_unslash() before sanitization.' It accesses $_POST['foo'] directly after checking isset().

```php
if ( isset( $_POST['foo'] ) ) {
    $foo = $_POST['foo']; // ...
```

--------------------------------

### Set minimum_wp_version property for WordPress.WP.DeprecatedFunctions sniff

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Configures the minimum_wp_version property to 5.2 for the WordPress.WP.DeprecatedFunctions sniff. Deprecations before this version will throw an error, while those between this version and the current release will throw a warning.

```xml
<rule ref="WordPress.WP.DeprecatedFunctions">
	<properties>
		<property name="minimum_wp_version" value="5.2"/>
	</properties>
</rule>
```

--------------------------------

### Update PEAR channel

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/How-to-use-WordPressCS-with-Eclipse-and-XAMPP

Update the pear.php.net channel as recommended by the previous warning. Output confirms the channel update succeeded.

```bash
C:\xampp\php>pear channel-update pear.php.net

Updating channel "pear.php.net"
Update of Channel "pear.php.net" succeeded
```

--------------------------------

### Add PHPCompatibilityWP to custom ruleset

Source: https://github.com/wordpress/wordpress-coding-standards/blob/develop/README.md

Adds the PHPCompatibilityWP ruleset to a custom PHP_CodeSniffer ruleset, including a config for testVersion and an include pattern for PHP files. Set testVersion to the PHP versions to check compatibility against; recommended setting is 7.2-.

```xml
<config name="testVersion" value="7.2-"/>
<rule ref="PHPCompatibilityWP">
    <include-pattern>*\.php$</include-pattern>
</rule>
```

--------------------------------

### Exclude one group from WordPress.WP.DiscouragedFunctions

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Use the `exclude` property with an array containing a single element to disable one group of checks for a sniff. In this example, the `query_posts` group is excluded from `WordPress.WP.DiscouragedFunctions`.

```xml
<!-- Exclude one group. -->
<rule ref="WordPress.WP.DiscouragedFunctions">
	<properties>
		<property name="exclude" type="array">
			<element value="query_posts"/>
		</property>
	</properties>
</rule>
```

--------------------------------

### Combine multiple violation codes in one ignore comment

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Ignoring-Parts-of-a-File

Multiple violation codes can be listed in a single `phpcs:ignore` comment, separated by commas. This example suppresses both `WordPress.Security.EscapeOutput.OutputNotEscaped` and `Generic.Files.EndFileNewline.NotFound`.

```php
echo $foo; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped,Generic.Files.EndFileNewline.NotFound
```

--------------------------------

### WordPressCS error output for non-sanitized input

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Fixing-errors-for-input-data

Shows the two errors reported by WordPressCS for the previous example: 'Detected usage of a non-sanitized input variable: $_POST' and 'Missing wp_unslash() before sanitization.'

```text
ERROR   | Detected usage of a non-sanitized input variable: $_POST 
ERROR   | Missing wp_unslash() before sanitization.
```

--------------------------------

### Clear PEAR cache again

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/How-to-use-WordPressCS-with-Eclipse-and-XAMPP

Clear the PEAR cache again after upgrades. Output shows 382 cache entries cleared.

```bash
C:\xampp\php>pear clear-cache

reading directory C:\Users\user\AppData\Local\Temp\pear\cache
382 cache entries cleared
```

--------------------------------

### Exclude multiple groups from WordPress.WP.DiscouragedFunctions

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Use the `exclude` property with an array containing multiple elements to disable several groups of checks for a sniff. In this example, both the `query_posts` and `wp_reset_query` groups are excluded from `WordPress.WP.DiscouragedFunctions`.

```xml
<!-- Exclude multiple groups. -->
<rule ref="WordPress.WP.DiscouragedFunctions">
	<properties>
		<property name="exclude" type="array">
			<element value="query_posts"/>
			<element value="wp_reset_query"/>
		</property>
	</properties>
</rule>
```

--------------------------------

### Clone WordPress Coding Standards repository

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/How-to-use-WordPressCS-with-Eclipse-and-XAMPP

Clone the WordPress-Coding-Standards repository into the CodeSniffer standards directory. If git is not available, use a GUI tool.

```bash
C:\xampp\php\pear\PHP\CodeSniffer\Standards>git clone 
https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards.git
```

--------------------------------

### Allow theme filename exceptions with is_theme property

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Sets the is_theme property to true for the WordPress.Files.FileName sniff to allow theme hierarchy specific filename exceptions like taxonomy-{custom_taxonomy}.php or archive-{post_type}.php.

```xml
<rule ref="WordPress.Files.FileName">
	<properties>
		<property name="is_theme" value="true"/>
	</properties>
</rule>
```

--------------------------------

### Verify WordPress standards are listed

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/How-to-use-WordPressCS-with-Eclipse-and-XAMPP

Check that the WordPress standards are now recognized by phpcs. Output includes WordPress, WordPress-Core, WordPress-Extra, and WordPress-VIP.

```bash
C:\xampp\php>phpcs -i

The installed coding standards are MySource, PEAR, PHPCS, PSR1, PSR2, 
Squiz, Zend, WordPress, WordPress-Core, WordPress-Extra and 
WordPress-VIP
```

--------------------------------

### Add custom word delimiters for WordPress.NamingConventions.ValidHookName

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Use the additionalWordDelimiters property to allow extra word separators in hook names. Each character in the value is treated as an allowed delimiter. The first example adds a dash, the second adds dash, slash, and dot.

```xml
<!-- Add one extra word delimiter. -->
<rule ref="WordPress.NamingConventions.ValidHookName">
	<properties>
		<property name="additionalWordDelimiters" value="-"/>
	</properties>
</rule>
```

```xml
<!-- Add several extra word delimiters. -->
<rule ref="WordPress.NamingConventions.ValidHookName">
	<properties>
		<property name="additionalWordDelimiters" value="-/."/>
	</properties>
</rule>
```

--------------------------------

### Ignore a single violation with phpcs:ignore

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Ignoring-Parts-of-a-File

Append a `phpcs:ignore` comment to a line to suppress a specific WordPressCS error. The comment must include the violation code, e.g., `WordPress.Security.EscapeOutput.OutputNotEscaped`. This example shows a safe output that would normally be flagged.

```php
function some_html() {
    return '<strong>bar</strong>';
}

$foo = some_html();

echo $foo; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
```

--------------------------------

### Namespace change: New use statement

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Upgrade-Guide-to-WordPressCS-2.0.0-for-Developers-of-external-standards

The new namespace is WordPressCS\WordPress. Update use statements or FQN references to WordPressCS sniffs accordingly.

```php
use WordPressCS\WordPress\Sniff;

class MyCustomSniff extends Sniff {}
```

--------------------------------

### Set minimum_wp_version globally via config directive

Source: https://github.com/wordpress/wordpress-coding-standards/wiki/Customizable-sniff-properties

Sets the minimum_wp_version configuration variable to 4.5, which applies to all sniffs using this property. This value takes priority over individual sniff property settings.

```xml
<config name="minimum_wp_version" value="4.5"/>
```
Tokens:
Raw