wpmu_validate_user_signup( string $user_name, string $user_email ): array

Description

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$user_namestring

The login name provided by the user.

$user_emailstring

The email provided by the user.

Return value

array

The array of user name, email, and the error messages.

• $user_namestring

  Sanitized and unique username.

• $orig_usernamestring

  Original username.

• $user_emailstring

  User email address.

• $errorsWP_Error

  WP_Error object containing any errors found.

Performance profile

How much work a call to wpmu_validate_user_signup() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reaches the database via ->get_row().

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

122–237

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 287.

Plugin surface

2 hooks

Third-party callbacks on 'illegal_user_logins', 'wpmu_validate_user_signup' run inside this call, and their cost is not bounded by anything here.

Called by

3

3 places in core call this, so the cost is paid more often than your own code shows.

What it touches

• optionnetwork optionget_site_option()called directly
• hookthird-party callbacksapply_filters()called directly
• sqldatabase query->get_row()called directly
• querycontent queryget_user_by()one call below wpmu_validate_user_signup()

Further down the call graph this can also reach cache, serialize and transient. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 1224 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wpmu_validate_user_signup() can have, taken from its control-flow graph on PHP 8.5.

This body has more branch combinations than are worth enumerating, so the table covers the outcomes found first rather than every one that exists.

Hooks and filters fired · 2

2 hooks fire while wpmu_validate_user_signup() runs, in this order:

1. 1
   apply_filters( illegal_user_logins )filterline 486 (+29 into the body)

   Filters the list of disallowed usernames.

2. 2
   apply_filters( wpmu_validate_user_signup )filterline 586 (+129 into the body)

   Filters the validated user registration details.

Uses · 13

• sanitize_user()Sanitizes a username, stripping out unsafe characters.
• __()Retrieves the translation of $text.
• sanitize_email()Strips out all characters that are not allowable in an email.
• get_site_option()Retrieve an option value for the current network based on name of option.
• add_site_option()Adds a new option for the current network.
• apply_filters()Calls the callback functions that have been added to a filter hook.
• is_email()Verifies that an email is valid.
• is_email_address_unsafe()Checks an email address against a list of banned domains.
• username_exists()Determines whether the given username exists.
• email_exists()Determines whether the given email exists.
• wp_login_url()Retrieves the login URL.
• mysql2date()Converts given MySQL date string into a different format.

Used by · 3

• WP_REST_Users_Controller::create_item()Creates a single user.
• validate_blog_signup()Validates new site signup.
• validate_user_form()Validates user sign-up name and email.

Source code

View on Trac ↗View on GitHub ↗

457function wpmu_validate_user_signup( $user_name, $user_email ) {458	global $wpdb;459 460	$errors = new WP_Error();461 462	$orig_username = $user_name;463	$user_name     = preg_replace( '/\s+/', '', sanitize_user( $user_name, true ) );464 465	if ( $user_name != $orig_username || preg_match( '/[^a-z0-9]/', $user_name ) ) {466		$errors->add( 'user_name', __( 'Usernames can only contain lowercase letters (a-z) and numbers.' ) );467		$user_name = $orig_username;468	}469 470	$user_email = sanitize_email( $user_email );471 472	if ( empty( $user_name ) ) {473		$errors->add( 'user_name', __( 'Please enter a username.' ) );474	}475 476	$illegal_names = get_site_option( 'illegal_names' );477	if ( ! is_array( $illegal_names ) ) {478		$illegal_names = array( 'www', 'web', 'root', 'admin', 'main', 'invite', 'administrator' );479		add_site_option( 'illegal_names', $illegal_names );480	}481	if ( in_array( $user_name, $illegal_names, true ) ) {482		$errors->add( 'user_name', __( 'Sorry, that username is not allowed.' ) );483	}484 485	/** This filter is documented in wp-includes/user.php */486	$illegal_logins = (array) apply_filters( 'illegal_user_logins', array() );487 488	if ( in_array( strtolower( $user_name ), array_map( 'strtolower', $illegal_logins ), true ) ) {489		$errors->add( 'user_name', __( 'Sorry, that username is not allowed.' ) );490	}491 492	if ( ! is_email( $user_email ) ) {493		$errors->add( 'user_email', __( 'Please enter a valid email address.' ) );494	} elseif ( is_email_address_unsafe( $user_email ) ) {495		$errors->add( 'user_email', __( 'You cannot use that email address to signup. There are problems with them blocking some emails from WordPress. Please use another email provider.' ) );496	}497 498	if ( strlen( $user_name ) < 4 ) {499		$errors->add( 'user_name', __( 'Username must be at least 4 characters.' ) );500	}501 502	if ( strlen( $user_name ) > 60 ) {503		$errors->add( 'user_name', __( 'Username may not be longer than 60 characters.' ) );504	}505 506	// All numeric?507	if ( preg_match( '/^[0-9]*$/', $user_name ) ) {508		$errors->add( 'user_name', __( 'Sorry, usernames must have letters too!' ) );509	}510 511	$limited_email_domains = get_site_option( 'limited_email_domains' );512	if ( is_array( $limited_email_domains ) && ! empty( $limited_email_domains ) ) {513		$limited_email_domains = array_map( 'strtolower', $limited_email_domains );514		$emaildomain           = strtolower( substr( $user_email, 1 + strpos( $user_email, '@' ) ) );515		if ( ! in_array( $emaildomain, $limited_email_domains, true ) ) {516			$errors->add( 'user_email', __( 'Sorry, that email address is not allowed!' ) );517		}518	}519 520	// Check if the username has been used already.521	if ( username_exists( $user_name ) ) {522		$errors->add( 'user_name', __( 'Sorry, that username already exists!' ) );523	}524 525	// Check if the email address has been used already.526	if ( email_exists( $user_email ) ) {527		$errors->add(528			'user_email',529			sprintf(530				/* translators: %s: Link to the login page. */531				__( '<strong>Error:</strong> This email address is already registered. <a href="%s">Log in</a> with this address or choose another one.' ),532				wp_login_url()533			)534		);535	}536