edit_user( int $user_id = 0 ): int|WP_Error

Description

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$user_idintoptional

User ID.Default: 0

Return value

int|WP_Error

User ID of the updated user or WP_Error on failure.

Performance profile

How much work a call to edit_user() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Expensive

Sends mail via wp_mail().

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

129–199

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 566.

Plugin surface

4 hooks

Third-party callbacks on 'check_passwords', 'illegal_user_logins', 'user_profile_update_errors' run inside this call, and their cost is not bounded by anything here.

Called by

2

2 places in core call this, so the cost is paid more often than your own code shows.

What it touches

• hookthird-party callbacksdo_action_ref_array()called directly
• querycontent queryget_user_by()one call below edit_user()
• optionnetwork optionget_site_option()one call below edit_user()
• mailsends mailwp_mail()one call below edit_user()

Further down the call graph this can also reach transient, cache, serialize and http. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 216 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost edit_user() can have, taken from its control-flow graph on PHP 8.5.

This body has more branch combinations than are worth enumerating, so the table covers the outcomes found first rather than every one that exists.

Hooks and filters fired · 4

4 hooks fire while edit_user() runs, in this order:

1. 1
   do_action( check_passwords )actionline 174 (+144 into the body)

   Fires before the password and confirm password fields are checked for congruity.

2. 2
   apply_filters( illegal_user_logins )filterline 204 (+174 into the body)

   Filters the list of disallowed usernames.

3. 3
   do_action( user_profile_update_errors )actionline 231 (+201 into the body)

   Fires before user profile update errors are returned.

4. 4
   do_action( edit_user_created_user )actionline 252 (+222 into the body)

   Fires after a new user has been created.

Uses · 30

• wp_roles()Retrieves the global WP_Roles instance and instantiates it if necessary.
• get_userdata()Retrieves user info by user ID.
• wp_slash()Adds slashes to a string or recursively adds slashes to strings within an array.
• sanitize_user()Sanitizes a username, stripping out unsafe characters.
• wp_unslash()Removes slashes from a string or recursively removes slashes from strings within an array.
• current_user_can()Returns whether the current user has the specified capability.
• sanitize_text_field()Sanitizes a string from user input or from the database.
• get_editable_roles()Fetch a filtered list of user roles that the current user is allowed to edit.
• wp_die()Kills WordPress execution and displays HTML page with an error message.
• __()Retrieves the translation of $text.
• is_multisite()Determines whether Multisite is enabled.
• get_current_user_id()Gets the current user's ID.

Used by · 2

• add_user()Creates a new user from the "Users" form using $_POST information.
• wp_ajax_add_user()Handles adding a user via AJAX.

Source code

View on Trac ↗View on GitHub ↗

30function edit_user( $user_id = 0 ) {31	$wp_roles = wp_roles();32	$user     = new stdClass();33	$user_id  = (int) $user_id;34	if ( $user_id ) {35		$update           = true;36		$user->ID         = $user_id;37		$userdata         = get_userdata( $user_id );38		$user->user_login = wp_slash( $userdata->user_login );39	} else {40		$update = false;41	}42 43	if ( ! $update && isset( $_POST['user_login'] ) ) {44		$user->user_login = sanitize_user( wp_unslash( $_POST['user_login'] ), true );45	}46 47	$errors = new WP_Error();48 49	$pass1 = '';50	$pass2 = '';51	if ( isset( $_POST['pass1'] ) ) {52		$pass1 = trim( $_POST['pass1'] );53	}54	if ( isset( $_POST['pass2'] ) ) {55		$pass2 = trim( $_POST['pass2'] );56	}57 58	if ( isset( $_POST['role'] ) && current_user_can( 'promote_users' ) && ( ! $user_id || current_user_can( 'promote_user', $user_id ) ) ) {59		$new_role = sanitize_text_field( $_POST['role'] );60 61		// If the new role isn't editable by the logged-in user die with error.62		$editable_roles = get_editable_roles();63		if ( ! empty( $new_role ) && empty( $editable_roles[ $new_role ] ) ) {64			wp_die( __( 'Sorry, you are not allowed to give users that role.' ), 403 );65		}66 67		$potential_role = isset( $wp_roles->role_objects[ $new_role ] ) ? $wp_roles->role_objects[ $new_role ] : false;68 69		/*70		 * Don't let anyone with 'promote_users' edit their own role to something without it.71		 * Multisite super admins can freely edit their roles, they possess all caps.72		 */73		if (74			( is_multisite() && current_user_can( 'manage_network_users' ) ) ||75			get_current_user_id() !== $user_id ||76			( $potential_role && $potential_role->has_cap( 'promote_users' ) )77		) {78			$user->role = $new_role;79		}80	}81 82	if ( isset( $_POST['email'] ) ) {83		$maybe_email = wp_unslash( $_POST['email'] );84		if ( is_string( $maybe_email ) && is_email( $maybe_email ) ) {85			$user->user_email = $maybe_email;86		} else {87			$errors->add( 'invalid_email', __( '<strong>Error:</strong> The email address is not correct.' ), array( 'form-field' => 'email' ) );88		}89	}90	if ( isset( $_POST['url'] ) ) {91		if ( empty( $_POST['url'] ) || 'http://' === $_POST['url'] ) {92			$user->user_url = '';93		} else {94			$user->user_url = sanitize_url( $_POST['url'] );95			$protocols      = implode( '|', array_map( 'preg_quote', wp_allowed_protocols() ) );96			$user->user_url = preg_match( '/^(' . $protocols . '):/is', $user->user_url ) ? $user->user_url : 'http://' . $user->user_url;97		}98	}99	if ( isset( $_POST['first_name'] ) ) {100		$user->first_name = sanitize_text_field( $_POST['first_name'] );101	}102	if ( isset( $_POST['last_name'] ) ) {103		$user->last_name = sanitize_text_field( $_POST['last_name'] );104	}105	if ( isset( $_POST['nickname'] ) ) {106		$user->nickname = sanitize_text_field( $_POST['nickname'] );107	}108	if ( isset( $_POST['display_name'] ) ) {109		$user->display_name = sanitize_text_field( $_POST['display_name'] );

Changelog

Introduced in 2.0.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 6.8.8 tag, from src/wp-admin/includes/user.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.