WordPress WooCommerce PHP Best Practices: Hooks, Standards & Security Guide

## Do
- **Employ hooks for extensions**: Integrate functionality via actions and filters instead of altering core files.
  *Example*: `add_action('woocommerce_before_add_to_cart_form', 'custom_cart_message');`

- **Adopt strict typing and modern PHP**: Declare `strict_types=1` and leverage PHP 7.4+ features like typed properties.
  *Example*:
  ```php
declare(strict_types=1);
class MyClass {
    public string $property;
}
```

- **Use WP/WC core functions and APIs**: Rely on built-ins like `wc_get_product()` for products or `wpdb->prepare()` for queries.
  *Example*: `$product = wc_get_product($post_id);`

- **Implement security essentials**: Apply nonces, sanitization, and validation with WP functions; use transients for caching.
  *Example*: `wp_verify_nonce($_POST['nonce'], 'my_action');`

- **Manage assets properly**: Enqueue scripts/styles via `wp_enqueue_script()` and `wp_enqueue_style()`.
  *Example*: `wp_enqueue_script('my-script', get_template_directory_uri() . '/js/script.js', ['jquery'], '1.0', true);`

- **Override WC templates correctly**: Place custom templates in `your-plugin/woocommerce/`.
  *Example*: Copy `single-product.php` to `plugins/my-plugin/woocommerce/single-product.php`.

- **Handle sessions and notices with WC tools**: Store temp data in sessions and display messages via notices.
  *Example*: `WC()->session->set('key', 'value'); wc_add_notice('Success!', 'success');`

## Don't
- **Modify core files directly**: Avoid editing WP or WC core to prevent update issues; use hooks instead.
  *Example (Don't)*: Hacking `wp-content/plugins/woocommerce/woocommerce.php`.

- **Skip database security**: Never use raw SQL without preparation; always use `wpdb->prepare()`.
  *Example (Don't)*: `$wpdb->query("SELECT * FROM table WHERE id = $id");`

- **Ignore naming conventions**: Don't use camelCase for directories; stick to lowercase-hyphen format.
  *Example (Don't)*: `wp-content/plugins/myPlugin` → Use `my-plugin`.

- **Overlook error handling**: Avoid unhandled exceptions; use try-catch and WP logging.
  *Example (Don't)*: Raw `file_get_contents()` without checks → Use `try { ... } catch (Exception $e) { wc_get_logger()->error($e->getMessage()); }`.

- **Reinvent WC features**: Don't query posts manually for products; use WC CRUD classes.
  *Example (Don't)*: `get_post($id)` → Use `wc_get_product($id)`.

- **Forget compatibility checks**: Don't assume WC is active; verify with `if (class_exists('WooCommerce'))`.
  *Example (Don't)*: Unconditional WC function calls without `function_exists()` or class checks.