wp_handle_comment_submission( array $comment_data ): WP_Comment|WP_Error

Description

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$comment_dataarray

Comment data.

• $comment_post_IDstring|int

  The ID of the post that relates to the comment.

• $authorstring

  The name of the comment author.

• $emailstring

  The comment author email address.

• $urlstring

  The comment author URL.

• $commentstring

  The content of the comment.

• $comment_parentstring|intdefault: 0

  The ID of this comment's parent, if any.

• $_wp_unfiltered_html_commentstring

  The nonce value for allowing unfiltered HTML.

Return value

WP_Comment|WP_Error

A WP_Comment object on success, a WP_Error object on failure.

Performance profile

How much work a call to wp_handle_comment_submission() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reaches the database via get_post().

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

34–190

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 343.

Plugin surface

8 hooks

Third-party callbacks on 'comment_reply_to_unapproved_comment', 'comment_id_not_found', 'comment_closed' run inside this call, and their cost is not bounded by anything here.

Called by

0

Nothing in core calls this; the cost is only what you spend yourself.

What it touches

• hookthird-party callbacksdo_action()called directly
• querycontent queryget_post()called directly
• optionoption read or writeget_option()called directly
• cacheobject cachewp_cache_get()one call below wp_handle_comment_submission()
• serializeserialisationmaybe_unserialize()one call below wp_handle_comment_submission()

Further down the call graph this can also reach transient. That is the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 369 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_handle_comment_submission() can have, taken from its control-flow graph on PHP 8.5.

This body has more branch combinations than are worth enumerating, so the table covers the outcomes found first rather than every one that exists.

Hooks and filters fired · 8

8 hooks fire while wp_handle_comment_submission() runs, in this order:

1. 1
   do_action( comment_reply_to_unapproved_comment )actionline 3575 (+43 into the body)

   Fires when a comment reply is attempted to an unapproved comment.

2. 2
   do_action( comment_id_not_found )actionline 3592 (+60 into the body)

   Fires when a comment is attempted on a post that does not exist.

3. 3
   do_action( comment_closed )actionline 3616 (+84 into the body)

   Fires when a comment is attempted on a post that has comments closed.

4. 4
   do_action( comment_on_trash )actionline 3629 (+97 into the body)

   Fires when a comment is attempted on a trashed post.

5. 5
   do_action( comment_on_draft )actionline 3642 (+110 into the body)

   Fires when a comment is attempted on a post in draft mode.

6. 6
   do_action( comment_on_password_protected )actionline 3658 (+126 into the body)

   Fires when a comment is attempted on a password-protected post.

7. 7
   do_action( pre_comment_on_post )actionline 3670 (+138 into the body)

   Fires before a comment is posted.

8. 8
   apply_filters( allow_empty_comment )filterline 3733 (+201 into the body)

   Filters whether an empty comment should be allowed.

Uses · 24

• absint()Converts a value to non-negative integer.
• get_comment()Retrieves comment data given a comment ID or comment object.
• do_action()Calls the callback functions that have been added to an action hook.
• __()Retrieves the translation of $text.
• get_post()Retrieves post data given a post ID or post object.
• get_post_status()Retrieves the post status based on the post ID.
• current_user_can()Returns whether the current user has the specified capability.
• get_post_status_object()Retrieves a post status object by name.
• comments_open()Determines whether the current post is open for comments.
• post_password_required()Determines whether the post requires password and whether a correct password has been provided.
• wp_get_current_user()Retrieves the current user object.
• wp_verify_nonce()Verifies that a correct security nonce was used with time limit.

Source code

View on Trac ↗View on GitHub ↗

3532function wp_handle_comment_submission( $comment_data ) {3533	$comment_post_id      = 0;3534	$comment_author       = '';3535	$comment_author_email = '';3536	$comment_author_url   = '';3537	$comment_content      = '';3538	$comment_parent       = 0;3539	$user_id              = 0;3540 3541	if ( isset( $comment_data['comment_post_ID'] ) ) {3542		$comment_post_id = (int) $comment_data['comment_post_ID'];3543	}3544	if ( isset( $comment_data['author'] ) && is_string( $comment_data['author'] ) ) {3545		$comment_author = trim( strip_tags( $comment_data['author'] ) );3546	}3547	if ( isset( $comment_data['email'] ) && is_string( $comment_data['email'] ) ) {3548		$comment_author_email = trim( $comment_data['email'] );3549	}3550	if ( isset( $comment_data['url'] ) && is_string( $comment_data['url'] ) ) {3551		$comment_author_url = trim( $comment_data['url'] );3552	}3553	if ( isset( $comment_data['comment'] ) && is_string( $comment_data['comment'] ) ) {3554		$comment_content = trim( $comment_data['comment'] );3555	}3556	if ( isset( $comment_data['comment_parent'] ) ) {3557		$comment_parent        = absint( $comment_data['comment_parent'] );3558		$comment_parent_object = get_comment( $comment_parent );3559 3560		if (3561			0 !== $comment_parent &&3562			(3563				! $comment_parent_object instanceof WP_Comment ||3564				0 === (int) $comment_parent_object->comment_approved3565			)3566		) {3567			/**3568			 * Fires when a comment reply is attempted to an unapproved comment.3569			 *3570			 * @since 6.2.03571			 *3572			 * @param int $comment_post_id Post ID.3573			 * @param int $comment_parent  Parent comment ID.3574			 */3575			do_action( 'comment_reply_to_unapproved_comment', $comment_post_id, $comment_parent );3576 3577			return new WP_Error( 'comment_reply_to_unapproved_comment', __( 'Sorry, replies to unapproved comments are not allowed.' ), 403 );3578		}3579	}3580 3581	$post = get_post( $comment_post_id );3582 3583	if ( empty( $post->comment_status ) ) {3584 3585		/**3586		 * Fires when a comment is attempted on a post that does not exist.3587		 *3588		 * @since 1.5.03589		 *3590		 * @param int $comment_post_id Post ID.3591		 */3592		do_action( 'comment_id_not_found', $comment_post_id );3593 3594		return new WP_Error( 'comment_id_not_found' );3595 3596	}3597 3598	// get_post_status() will get the parent status for attachments.3599	$status = get_post_status( $post );3600 3601	if ( ( 'private' === $status ) && ! current_user_can( 'read_post', $comment_post_id ) ) {3602		return new WP_Error( 'comment_id_not_found' );3603	}3604 3605	$status_obj = get_post_status_object( $status );3606 3607	if ( ! comments_open( $comment_post_id ) ) {3608 3609		/**3610		 * Fires when a comment is attempted on a post that has comments closed.3611		 *

Changelog

Introduced in 4.4.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 6.8.8 tag, from src/wp-includes/comment.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.