wp_create_nonce() WordPress Function

The wp_create_nonce() function is used to create a cryptographic nonce (a number used once) for use in a form or URL. Nonces are used to protect URLs and forms from certain types of attacks, like cross-site request forgery (CSRF).

wp_create_nonce( string|int $action = -1 ) #

Creates a cryptographic token tied to a specific action, user, user session, and window of time.


Parameters

$action

(string|int)(Optional)Scalar value to add context to the nonce.

Default value: -1


Top ↑

Return

(string) The token.


Top ↑

More Information

The function should be called using the init or any subsequent action hook. Calling it outside of an action hook can lead to problems, see the ticket #14024 for details.


Top ↑

Source

File: wp-includes/pluggable.php

	function wp_create_nonce( $action = -1 ) {
		$user = wp_get_current_user();
		$uid  = (int) $user->ID;
		if ( ! $uid ) {
			/** This filter is documented in wp-includes/pluggable.php */
			$uid = apply_filters( 'nonce_user_logged_out', $uid, $action );
		}

		$token = wp_get_session_token();
		$i     = wp_nonce_tick();

		return substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 );
	}


Top ↑

Changelog

Changelog
VersionDescription
4.0.0Session tokens were integrated with nonce creation
2.0.3Introduced.

The content displayed on this page has been created in part by processing WordPress source code files which are made available under the GPLv2 (or a later version) license by theĀ Free Software Foundation. In addition to this, the content includes user-written examples and information. All material is subject to review and curation by the WPPaste.com community.

Show More