Publishing to WordPress from outside the admin panel

Note: This article has been marked for a quality review and will soon be updated.

I recently finished up a theme for which I had to allow users to post to WordPress from outside the admin panel. Now at first you may wonder why anyone would want to do such a thing, but let me tell you of my scenario. Basically I was creating a job board whereby users could post a job from a specific page – this meant that the numerous custom fields in operation could be handled in a rather aesthetically pleasing fashion and it would be a lot simpler for the user to get their job listed. Now the reason I’m posting this article is because this subject isn’t well documented and I had to play around for quite a while before I could get it to work, so I hope that I can save you some frustration in sharing my code.

So what do we have to do first? Well we need to replicate the core features of the new post page in the admin panel of WordPress, this means replicating things such as the title and content fields, the category options, and the tags area. So set up all the required fields and any custom fields you want to include. Once you’ve done this you will need to create a separate file to post the information to, let’s call it new-post.php. Set your form to post to this file, and then paste in the following code.

$title = stripslashes($_POST['title']);
$body = $_POST['body'];
$rpcurl = $_POST['rpcurl'];
$username = $_POST['user'];
$password = $_POST['pass'];
$category = $_POST['category'];
$keywords = $_POST['tags'];
$encoding = 'UTF-8';

$title = htmlentities($title,ENT_NOQUOTES,$encoding);
$keywords = htmlentities($keywords,ENT_NOQUOTES,$encoding);

$content = array(
'title'=>$title,
'description'=>$body,
'mt_allow_comments'=>0,  // 1 to allow comments
'mt_allow_pings'=>0,  // 1 to allow trackbacks
'post_type'=>'post',
'mt_keywords'=>$keywords,
'categories'=> array($category=>$category),
)

);
$params = array(0,$username,$password,$content,true);
$request = xmlrpc_encode_request('metaWeblog.newPost',$params);
$ch = curl_init();
curl_setopt($ch, CURLOPT_POSTFIELDS, $request);
curl_setopt($ch, CURLOPT_URL, $rpcurl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 1);
$results = curl_exec($ch);
curl_close($ch);

Right, now that’s quite a lot of code, allow me to explain. You can see all of those variables at the top – these are to be use further down and are given the values of what’s posted to them. Title, body, category, and keywords are self-explanatory, however there are a number of other variables which appear to require some post variables – so what are they? $rpcurl is simply the ping-back URL of your blog – which is a URL that allows others to interact with your blog. The username and password variables must be valid credentials for the blog – this is because WordPress needs to verify that the person posting the post is allowed to do so. And finally the encoding variable is simple the way in which the content should be encoded – the default and most common is simple UTF-8 – and doesn’t need to be changed.

So you know what the variables are, but how on earth do you get them to the file? Well personally I used AJAX to submit the form and so just sent the data in a data-string, but if that sounds too much like hard work, feel free to just use some hidden fields. To access the required data you can use the bloginfo() function for things like the “pingback_url”. Now one thing that will require user input is the password variable, this is because it is impossible to obtain the user’s password as it is stored as an encrypted hash, so I’d recommend that you add it as a security feature where you ask users to enter their password before posting – that way it’ll be accessible to you.

The rest of the code simply posts all the info to the actual blog, and uses the ping-back URL to do so by inserting all of those lovely variables into place and then sending it over to WordPress to do all the hard work.

While this is a bit of an obscure function I think it’s nice to know it can be done, and I hope this article can save some people the hassle that I had to go through to get the correct method and syntax.

Update

It has come to my attention that the method listed above might be a little hard to integrate into a WordPress theme, so below is the code for a form with which you could use the above method, to post to WordPress from outside the admin panel. Let’s get started with the form.

<form id="post" name="post" action="post.php" method="post">

<label for="title">Title</label>
<input type="text" name="post_title" />

<label for="desc">Content</label>
<textarea name="content"></textarea>

<label for="category">Category</label>
<input name="category" type="text" />


<label for="title">Tags</label>
<input type="text" name="post_tags" id="tags" value="e.g. Graphic, Designer, HTML" onfocus="if (this.value == 'e.g. Graphic, Designer, HTML') {this.value = '';}" onblur="if (this.value == '') {this.value = 'e.g. Graphic, Designer, HTML';}" />

<p>Please verify the details above and then enter your password to complete the process.</p>
<p>&nbsp;</p>
<label for="password">Password</label>
<input type="password" name="password" id="password" />
<input type="submit" value="Submit" />
</div>
</form>

So that’s a pretty standard form to which you can do whatever you like, but not the names of the fields as they will be important when we come to using the data stored in them. Next I’m going to use AJAX to post the form to the code which will post the WordPress, for the sake of this tutorial I’ll assume that the code at the beginning of this tutorial is in a file called post.php. So go ahead and stick this somewhere on your page (Note: You will need to include jQuery for the following Javascript to work.

$("#post").submit(function(){
	var title = $("#post input[name=post_title]").val();
	var body = $("#post textarea[name=content]").val();
	var category = $("#post select[name=category]").val();
	var tags = $("input[name=post_tags]").val();
	
	var pass = $("#password").val();
	
	if(title=="" || body=="" || pass==""){
		alert("Please fill in all of the fields!");
		return false;
	}else {
		verify = true;
		
		var dataString = 'title=' + title + '&body=' + body + '&rpcurl=&user=user_login ?>&pass=' + pass + '&category=' + category + '&tags=' + tags;
		$.ajax({
			type: "POST",
			url: "post.php",
			data: dataString, 
		}   		
	});
	return false;
}

Okay then what do we have here? Well first off all the code is wrapped in a submit() function, which waits for the form to be submitted, and then executes the code inside. Just below this we assign the values of the inputs from the form, to variables, and then check to see if some of the fields are empty, the ones that are important that is. If any of them are empty then we alert the user and stop the form from going submitting. However if it’s all good we then use the jQuery AJAX function to post all the information we have to our post.php file to be processed. Notice that we ask the user to verify the information entered by asking them to enter their password – this is a sneaky way of grabbing their password, and allows us to proceed with processing the post.

And that’s that! Hopefully the above code has helped you to understand better how to integrate the code into a WordPresss environment, and if you’re a little confused by the AJAX or just don’t want it in your code, feel free to just make the form post directly to post.php, and you should be good to go.