Lubinik Metabox Lifecycle & Secure Saving

Training mode

Lubinik Metabox Lifecycle & Secure Saving

Time remaining:

0 / 20 answered

1. Which hook normally registers Lubinik addon metaboxes?

Which hook normally registers Lubinik addon metaboxes? wp_footer shutdown template_redirect add_meta_boxes

Hint
Follow the request boundary and normalize each field by type.
2. What does the screen argument in add_meta_box identify?

What does the screen argument in add_meta_box identify? The current user role The frontend template The post type/edit screen receiving the box The database table

Hint
Follow the request boundary and normalize each field by type.
3. What does the normal context request?

What does the normal context request? A normal-priority hook A database transaction Placement in the main editor column Frontend visibility

Hint
Follow the request boundary and normalize each field by type.
4. What does high mean in add_meta_box arguments?

What does high mean in add_meta_box arguments? Security level Display priority within its context User capability Hook accepted arguments

Hint
Follow the request boundary and normalize each field by type.
5. What is the metabox render callback responsible for?

What is the metabox render callback responsible for? Reading current values and outputting fields plus a nonce Registering rewrite rules Authenticating API providers Saving every post immediately

Hint
Follow the request boundary and normalize each field by type.
6. Why call wp_nonce_field() inside the box?

Why call wp_nonce_field() inside the box? To grant edit capability To sanitize all fields To send a token binding the later save request to an intended action To prevent autosaves

Hint
Follow the request boundary and normalize each field by type.
7. What must wp_verify_nonce receive?

What must wp_verify_nonce receive? The post title and slug The field sanitizer The user password The submitted token and the same action used to create it

Hint
Follow the request boundary and normalize each field by type.
8. What should a save handler do if its nonce field is absent?

What should a save handler do if its nonce field is absent? Delete all metadata Return without changing metadata Save with defaults Create a new nonce server-side

Hint
Follow the request boundary and normalize each field by type.
9. What should happen when nonce verification fails?

What should happen when nonce verification fails? Grant administrator capability Publish the post Abort that metadata save Retry with no nonce

Hint
Follow the request boundary and normalize each field by type.
10. Does a valid nonce prove the user may edit the post?

Does a valid nonce prove the user may edit the post? Only for media fields Only for administrators Yes, always No, current_user_can must check authorization separately

Hint
Follow the request boundary and normalize each field by type.
11. Why check DOING_AUTOSAVE?

Why check DOING_AUTOSAVE? To validate URLs To disable revisions permanently To avoid overwriting metadata during an incomplete automatic save To enqueue admin CSS

Hint
Follow the request boundary and normalize each field by type.
12. Why is a revision guard also useful in robust save handlers?

Why is a revision guard also useful in robust save handlers? To prevent all post history To load media scripts To avoid treating a revision ID as the canonical entity To register the CPT

Hint
Follow the request boundary and normalize each field by type.
13. Why use current_user_can(“edit_post”, $post_id)?

Why use current_user_can(“edit_post”, $post_id)? It sanitizes the ID It checks the post type slug only WordPress maps authorization to the specific post and user It verifies the nonce

Hint
Follow the request boundary and normalize each field by type.
14. What advantage does save_post_pet_tip have over generic save_post?

What advantage does save_post_pet_tip have over generic save_post? It automatically sanitizes POST It skips all security checks It runs only once globally The handler runs only for that post type

Hint
Follow the request boundary and normalize each field by type.
15. Why check isset($_POST[field]) before saving?

Why check isset($_POST[field]) before saving? POST fields are always present It verifies capability The field may not be part of this request It escapes output

Hint
Follow the request boundary and normalize each field by type.
16. Why output a hidden no value before a yes checkbox?

Why output a hidden no value before a yes checkbox? It stores two meta rows Unchecked submissions still send an explicit no value It hides the checkbox It creates a nonce

Hint
Follow the request boundary and normalize each field by type.
17. How should a yes/no checkbox be normalized?

How should a yes/no checkbox be normalized? Cast every string to true Use esc_html only Store yes only for the exact expected value, otherwise no Store raw POST

Hint
Follow the request boundary and normalize each field by type.
18. Why delete optional meta when its cleaned value becomes empty?

Why delete optional meta when its cleaned value becomes empty? It creates a default term It enqueues scripts It distinguishes absence and avoids stale or meaningless stored rows It improves nonce strength

Hint
Follow the request boundary and normalize each field by type.
19. Does update_post_meta returning false always mean a security failure?

Does update_post_meta returning false always mean a security failure? Yes, it proves no capability No, because it always returns an ID Yes, it proves nonce failure No, it may mean the value was unchanged or the update failed

Hint
Follow the request boundary and normalize each field by type.
20. How should a stored text value be printed into an input value attribute?

How should a stored text value be printed into an input value attribute? With wp_create_nonce Raw because it was sanitized With esc_attr at output With esc_sql

Hint
Follow the request boundary and normalize each field by type.

1. Which hook normally registers Lubinik addon metaboxes?

2. What does the screen argument in add_meta_box identify?

3. What does the normal context request?

4. What does high mean in add_meta_box arguments?

5. What is the metabox render callback responsible for?

6. Why call wp_nonce_field() inside the box?

7. What must wp_verify_nonce receive?

8. What should a save handler do if its nonce field is absent?

9. What should happen when nonce verification fails?

10. Does a valid nonce prove the user may edit the post?

11. Why check DOING_AUTOSAVE?

12. Why is a revision guard also useful in robust save handlers?

13. Why use current_user_can(“edit_post”, $post_id)?

14. What advantage does save_post_pet_tip have over generic save_post?

15. Why check isset($_POST[field]) before saving?

16. Why output a hidden no value before a yes checkbox?

17. How should a yes/no checkbox be normalized?

18. Why delete optional meta when its cleaned value becomes empty?

19. Does update_post_meta returning false always mean a security failure?

20. How should a stored text value be printed into an input value attribute?