wp_handle_comment_submission( array $comment_data ): WP_Comment|WP_Error

Description

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$comment_dataarray

Comment data.

• $comment_post_IDstring|int

  The ID of the post that relates to the comment.

• $authorstring

  The name of the comment author.

• $emailstring

  The comment author email address.

• $urlstring

  The comment author URL.

• $commentstring

  The content of the comment.

• $comment_parentstring|intdefault: 0

  The ID of this comment's parent, if any.

• $_wp_unfiltered_html_commentstring

  The nonce value for allowing unfiltered HTML.

Return value

WP_Comment|WP_Error

A WP_Comment object on success, a WP_Error object on failure.

Performance profile

How much work a call to wp_handle_comment_submission() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reaches the database via get_post().

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

34–190

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 343.

Plugin surface

8 hooks

Third-party callbacks on 'comment_reply_to_unapproved_comment', 'comment_id_not_found', 'comment_closed' run inside this call, and their cost is not bounded by anything here.

Called by

0

Nothing in core calls this; the cost is only what you spend yourself.

What it touches

• hookthird-party callbacksdo_action()called directly
• querycontent queryget_post()called directly
• optionoption read or writeget_option()called directly
• cacheobject cachewp_cache_get()one call below wp_handle_comment_submission()
• serializeserialisationmaybe_unserialize()one call below wp_handle_comment_submission()

Further down the call graph this can also reach transient. That is the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 369 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_handle_comment_submission() can have, taken from its control-flow graph on PHP 8.5.

This body has more branch combinations than are worth enumerating, so the table covers the outcomes found first rather than every one that exists.

Hooks and filters fired · 8

8 hooks fire while wp_handle_comment_submission() runs, in this order:

1. 1
   do_action( comment_reply_to_unapproved_comment )actionline 3532 (+43 into the body)

   Fires when a comment reply is attempted to an unapproved comment.

2. 2
   do_action( comment_id_not_found )actionline 3549 (+60 into the body)

   Fires when a comment is attempted on a post that does not exist.

3. 3
   do_action( comment_closed )actionline 3573 (+84 into the body)

   Fires when a comment is attempted on a post that has comments closed.

4. 4
   do_action( comment_on_trash )actionline 3586 (+97 into the body)

   Fires when a comment is attempted on a trashed post.

5. 5
   do_action( comment_on_draft )actionline 3599 (+110 into the body)

   Fires when a comment is attempted on a post in draft mode.

6. 6
   do_action( comment_on_password_protected )actionline 3615 (+126 into the body)

   Fires when a comment is attempted on a password-protected post.

7. 7
   do_action( pre_comment_on_post )actionline 3627 (+138 into the body)

   Fires before a comment is posted.

8. 8
   apply_filters( allow_empty_comment )filterline 3690 (+201 into the body)

   Filters whether an empty comment should be allowed.

Uses · 24

• absint()Converts a value to non-negative integer.
• get_comment()Retrieves comment data given a comment ID or comment object.
• do_action()Calls the callback functions that have been added to an action hook.
• __()Retrieves the translation of $text.
• get_post()Retrieves post data given a post ID or post object.
• get_post_status()Retrieves the post status based on the post ID.
• current_user_can()Returns whether the current user has the specified capability.
• get_post_status_object()Retrieves a post status object by name.
• comments_open()Determines whether the current post is open for comments.
• post_password_required()Determines whether the post requires password and whether a correct password has been provided.
• wp_get_current_user()Retrieves the current user object.
• wp_verify_nonce()Verifies that a correct security nonce was used with time limit.

Source code

View on Trac ↗View on GitHub ↗

3489function wp_handle_comment_submission( $comment_data ) {3490	$comment_post_id      = 0;3491	$comment_author       = '';3492	$comment_author_email = '';3493	$comment_author_url   = '';3494	$comment_content      = '';3495	$comment_parent       = 0;3496	$user_id              = 0;3497 3498	if ( isset( $comment_data['comment_post_ID'] ) ) {3499		$comment_post_id = (int) $comment_data['comment_post_ID'];3500	}3501	if ( isset( $comment_data['author'] ) && is_string( $comment_data['author'] ) ) {3502		$comment_author = trim( strip_tags( $comment_data['author'] ) );3503	}3504	if ( isset( $comment_data['email'] ) && is_string( $comment_data['email'] ) ) {3505		$comment_author_email = trim( $comment_data['email'] );3506	}3507	if ( isset( $comment_data['url'] ) && is_string( $comment_data['url'] ) ) {3508		$comment_author_url = trim( $comment_data['url'] );3509	}3510	if ( isset( $comment_data['comment'] ) && is_string( $comment_data['comment'] ) ) {3511		$comment_content = trim( $comment_data['comment'] );3512	}3513	if ( isset( $comment_data['comment_parent'] ) ) {3514		$comment_parent        = absint( $comment_data['comment_parent'] );3515		$comment_parent_object = get_comment( $comment_parent );3516 3517		if (3518			0 !== $comment_parent &&3519			(3520				! $comment_parent_object instanceof WP_Comment ||3521				0 === (int) $comment_parent_object->comment_approved3522			)3523		) {3524			/**3525			 * Fires when a comment reply is attempted to an unapproved comment.3526			 *3527			 * @since 6.2.03528			 *3529			 * @param int $comment_post_id Post ID.3530			 * @param int $comment_parent  Parent comment ID.3531			 */3532			do_action( 'comment_reply_to_unapproved_comment', $comment_post_id, $comment_parent );3533 3534			return new WP_Error( 'comment_reply_to_unapproved_comment', __( 'Sorry, replies to unapproved comments are not allowed.' ), 403 );3535		}3536	}3537 3538	$post = get_post( $comment_post_id );3539 3540	if ( empty( $post->comment_status ) ) {3541 3542		/**3543		 * Fires when a comment is attempted on a post that does not exist.3544		 *3545		 * @since 1.5.03546		 *3547		 * @param int $comment_post_id Post ID.3548		 */3549		do_action( 'comment_id_not_found', $comment_post_id );3550 3551		return new WP_Error( 'comment_id_not_found' );3552 3553	}3554 3555	// get_post_status() will get the parent status for attachments.3556	$status = get_post_status( $post );3557 3558	if ( ( 'private' === $status ) && ! current_user_can( 'read_post', $comment_post_id ) ) {3559		return new WP_Error( 'comment_id_not_found' );3560	}3561 3562	$status_obj = get_post_status_object( $status );3563 3564	if ( ! comments_open( $comment_post_id ) ) {3565 3566		/**3567		 * Fires when a comment is attempted on a post that has comments closed.3568		 *

Changelog

Introduced in 4.4.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 6.7.7 tag, from src/wp-includes/comment.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.