check_comment( string $author, string $email, string $url, string $comment, string $user_ip, string $user_agent, string $comment_type ): bool

Description

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$authorstring

Comment author name.

$emailstring

Comment author email.

$urlstring

Comment author URL.

$commentstring

Content of the comment.

$user_ipstring

Comment author IP address.

$user_agentstring

Comment author User-Agent.

$comment_typestring

Comment type, either user-submitted comment, trackback, or pingback.

Return value

bool

If all checks pass, true, otherwise false.

Performance profile

How much work a call to check_comment() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reaches the database via ->get_var().

Scaling

Scales with input

The body loops, so the work grows with what you pass in.

Instructions

14–99

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 178.

Plugin surface

3 hooks

Third-party callbacks on 'comment_text', 'comment_max_links_url', 'wp_auto_approve_ping' run inside this call, and their cost is not bounded by anything here.

Called by

1

1 place in core call this, so the cost is paid more often than your own code shows.

What it touches

• optionoption read or writeget_option()called directly
• hookthird-party callbacksapply_filters()called directly
• querycontent queryget_user_by()called directly
• regexregular expression over the whole inputpreg_match_all()called directly
• sqldatabase query->get_var()called directly
• cacheobject cachewp_cache_get()one call below check_comment()
• serializeserialisationmaybe_unserialize()one call below check_comment()

Further down the call graph this can also reach transient. That is the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 20 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost check_comment() can have, taken from its control-flow graph on PHP 8.5.

Hooks and filters fired · 3

3 hooks fire while check_comment() runs, in this order:

1. 1
   apply_filters( comment_text )filterline 52 (+9 into the body)

   Filters the text of a comment to be displayed.

2. 2
   apply_filters( comment_max_links_url )filterline 69 (+26 into the body)

   Filters the number of links found in a comment.

3. 3
   apply_filters( wp_auto_approve_ping )filterline 197 (+154 into the body)

   Filters whether a pingback is approved without being held for moderation.

Uses · 7

• get_option()Retrieves an option value based on an option name.
• apply_filters()Calls the callback functions that have been added to a filter hook.
• get_user_by()Retrieves user info by a given field.
• wp_unslash()Removes slashes from a string or recursively removes slashes from strings within an array.
• str_contains()Polyfill for `str_contains()` function added in PHP 8.0.
• url_to_postid()Examines a URL and try to determine the post ID it represents.
• get_post_status()Retrieves the post status based on the post ID.

Used by · 1

• wp_check_comment_data()Checks whether comment data passes internal checks or has disallowed content.

Source code

View on Trac ↗View on GitHub ↗

43function check_comment( $author, $email, $url, $comment, $user_ip, $user_agent, $comment_type ) {44	global $wpdb;45 46	// If manual moderation is enabled, skip all checks and return false.47	if ( '1' === get_option( 'comment_moderation' ) ) {48		return false;49	}50 51	/** This filter is documented in wp-includes/comment-template.php */52	$comment = apply_filters( 'comment_text', $comment, null, array() );53 54	// Check for the number of external links if a max allowed number is set.55	$max_links = get_option( 'comment_max_links' );56	if ( $max_links ) {57		$num_links = preg_match_all( '/<a [^>]*href/i', $comment, $out );58 59		/**60		 * Filters the number of links found in a comment.61		 *62		 * @since 3.0.063		 * @since 4.7.0 Added the `$comment` parameter.64		 *65		 * @param int    $num_links The number of links found.66		 * @param string $url       Comment author's URL. Included in allowed links total.67		 * @param string $comment   Content of the comment.68		 */69		$num_links = apply_filters( 'comment_max_links_url', $num_links, $url, $comment );70 71		/*72		 * If the number of links in the comment exceeds the allowed amount,73		 * fail the check by returning false.74		 */75		if ( $num_links >= $max_links ) {76			return false;77		}78	}79 80	$mod_keys = trim( get_option( 'moderation_keys' ) );81 82	// If moderation 'keys' (keywords) are set, process them.83	if ( ! empty( $mod_keys ) ) {84		$words = explode( "\n", $mod_keys );85 86		foreach ( (array) $words as $word ) {87			$word = trim( $word );88 89			// Skip empty lines.90			if ( empty( $word ) ) {91				continue;92			}93 94			/*95			 * Do some escaping magic so that '#' (number of) characters in the spam96			 * words don't break things:97			 */98			$word = preg_quote( $word, '#' );99 100			/*101			 * Check the comment fields for moderation keywords. If any are found,102			 * fail the check for the given field by returning false.103			 */104			$pattern = "#$word#iu";105			if ( preg_match( $pattern, $author ) ) {106				return false;107			}108			if ( preg_match( $pattern, $email ) ) {109				return false;110			}111			if ( preg_match( $pattern, $url ) ) {112				return false;113			}114			if ( preg_match( $pattern, $comment ) ) {115				return false;116			}117			if ( preg_match( $pattern, $user_ip ) ) {118				return false;119			}120			if ( preg_match( $pattern, $user_agent ) ) {121				return false;122			}

Changelog

Introduced in 1.2.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/comment.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.