WordPress PHP Best Practices: Essential Coding Rules and Standards Guide

**Do:**
- Adopt WordPress coding standards and PHP 7.4+ features like strict typing for robust code.
  *Example:*
  ```php
  <?php
declare(strict_types=1);

function get_user_data(int $user_id): ?array {
    global $wpdb;
    return $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->users} WHERE ID = %d", $user_id), ARRAY_A);
}
  ```

**Don't:**
- Ignore strict typing or use loose database queries without preparation.
  *Example (Avoid):*
  ```php
  <?php
  $result = $wpdb->get_row("SELECT * FROM users WHERE ID = $user_id"); // Vulnerable to SQL injection
  ```

**Do:**
- Leverage hooks (actions/filters) for extensions and enqueue assets properly.
  *Example:*
  ```php
  add_action('wp_enqueue_scripts', function() {
      wp_enqueue_style('my-theme-style', get_template_directory_uri() . '/style.css');
  });
  ```

**Don't:**
- Directly edit core files or hardcode scripts/styles.
  *Example (Avoid):*
  ```php
  echo '<script>alert("hello");</script>'; // Blocks rendering, insecure
  ```

**Do:**
- Sanitize inputs, verify nonces, and use wpdb with prepare() for DB ops.
  *Example:*
  ```php
  if (wp_verify_nonce($_POST['nonce'], 'my_action')) {
      $data = sanitize_text_field($_POST['data']);
      $wpdb->insert('my_table', ['value' => $data]);
  }
  ```

**Don't:**
- Skip validation or use raw SQL without escaping.
  *Example (Avoid):*
  ```php
  $wpdb->query("INSERT INTO my_table (value) VALUES ('$_POST[data]")"); // Unsafe
  ```

**Do:**
- Structure files with lowercase hyphens, use OOP for modularity, and transients for caching.
  *Example:*
  ```php
  // In wp-content/plugins/my-plugin/my-module.php
  class MyModule {
      public function get_cached_data(string $key): mixed {
          return get_transient($key);
      }
  }
  ```

**Don't:**
- Duplicate code or use unclear naming like single letters.
  *Example (Avoid):*
  ```php
  function x($a) { return $a * 2; } // Unclear
  ```

**Do:**
- Handle errors with try-catch, WP debug logging, and wp_cron for tasks; internationalize with i18n.
  *Example:*
  ```php
  try {
      // risky operation
  } catch (Exception $e) {
      error_log('Error: ' . $e->getMessage());
  }
  __('My Text', 'my-plugin');
  ```

**Don't:**
- Rely on direct cron or neglect localization.
  *Example (Avoid):*
  ```php
  echo 'My Text'; // Not translatable