调用自定义代码时WordPress admin-ajax.php返回500/400状态码问题

异常现象 #

• 管理员登录状态下，AJAX请求返回500状态码；未登录时返回400错误请求
• 未登录用户及其他用户访问页面时，页面显示后台顶部栏

本地MAMP环境运行正常，服务器与本地WordPress环境、插件配置一致，相关代码如下：

前端脚本 #

jQuery(document).ready(function($) {
    // Event listener for changes in the first dropdown (#region_filter)
    $('#region_filter').on('change', function() {
        // Fetch selected region values
        var selectedRegions = $(this).val();

        // Make an AJAX request to retrieve corresponding areas for selected regions
        $.ajax({
            url: "domain.org/wp-admin/admin-ajax.php",          
            type: 'POST',
            data: {
                action:'eAtlasFiltersRegions',
                regions: selectedRegions
            },
            success: function(response) {
                // Parse the JSON response
                var areas = JSON.parse(response);

                // Clear and update the third dropdown (#isra_filter) options
                var israDropdown = $('#isra_filter');
                israDropdown.empty();
                israDropdown.append($('<option value="">Search area names</option>'));
                israDropdown.append($('<option value="all">SELECT ALL</option>'));

                // Add retrieved area names to the dropdown
                areas.forEach(function(area) {
                    israDropdown.append($('<option value="' + area + '">' + area + '</option>'));
                });

                // Refresh the dropdown to apply changes
                israDropdown.dropdown('refresh');
            }
        });

    });
 
});

functions.php中的代码 #

add_action('wp_ajax_eAtlasFiltersRegions', 'eAtlasFiltersRegions');

function eAtlasFiltersRegions(){
    global $wpdb;
    
    if (isset($_POST['regions'])) {
      // Get the selected regions from the AJAX request
      $selectedRegions = $_POST['regions'];
      console.log($selectedRegions);

      // Construct the SQL query to retrieve areas based on selected regions
      $query = "SELECT DISTINCT area_name FROM isra_map_area_names WHERE region_code IN (SELECT region_code FROM isra_map_regions WHERE region IN (";
      $regionValues = array_map(function($region) {
          // Sanitize and escape each selected region
          return "'" . addslashes($region) . "'";
      }, $selectedRegions);
      $query .= implode(",", $regionValues) . ")) ORDER BY `area_name` ASC";
      // Execute the query
      $query_results = $wpdb->get_results($query);
  
      // Extract area names from the query results
      $areaNames = array();
      foreach ($query_results as $result) {
          $areaNames[] = stripslashes($result->area_name);
      }
  
      // Return the area names as a JSON response
      echo json_encode($areaNames);
  } else {
      // Return an empty JSON response if no regions are selected
      if (isset($_POST['regions']) & $_POST['regions'] =='') {
        $query_area_name = $wpdb->get_results("SELECT * FROM isra_map_area_names ORDER BY `area_name` ASC", ARRAY_A);
         // Extract area names from the query results
      $areaNames = array();
      foreach ($query_results as $result) {
          $areaNames[] = stripslashes($result->area_name);
      }
  
      // Return the area names as a JSON response
      echo json_encode($areaNames);
      }
  }
  wp_die();  

}

问题分析与修复方案 #

1. 未登录400错误：AJAX权限缺失 #

当前仅注册了登录用户可用的wp_ajax_eAtlasFiltersRegions动作，未登录用户无法触发该接口，需添加未登录用户的动作钩子：

add_action('wp_ajax_eAtlasFiltersRegions', 'eAtlasFiltersRegions');
add_action('wp_ajax_nopriv_eAtlasFiltersRegions', 'eAtlasFiltersRegions'); // 新增此行

2. 登录状态500错误：代码致命问题 #

• PHP中调用前端console.log：PHP没有该函数，直接导致致命错误，替换为服务器日志输出或删除：

  // 替换 console.log($selectedRegions); 为
  error_log(print_r($selectedRegions, true)); // 写入服务器错误日志，方便调试
  

• SQL拼接存在注入风险与语法隐患：手动拼接SQL易引发注入，改用WordPress官方推荐的$wpdb->prepare安全构造查询：

  // 原SQL拼接部分替换为：
  $placeholders = implode(',', array_fill(0, count($selectedRegions), '%s'));
  $query = $wpdb->prepare(
      "SELECT DISTINCT area_name FROM isra_map_area_names 
       WHERE region_code IN (
           SELECT region_code FROM isra_map_regions WHERE region IN ($placeholders)
       ) ORDER BY `area_name` ASC",
      $selectedRegions
  );
  

• else分支逻辑错误：else分支内判断isset($_POST['regions'])永远不成立（已进入else分支），且$query_results未定义，导致报错，修正逻辑：

  } else {
      // 未选择区域时返回所有地区
      $query_results = $wpdb->get_results("SELECT area_name FROM isra_map_area_names ORDER BY `area_name` ASC");
      $areaNames = array();
      foreach ($query_results as $result) {
          $areaNames[] = stripslashes($result->area_name);
      }
      echo json_encode($areaNames);
  }
  

• AJAX URL硬编码：前端URL写死域名，适配性差，改用动态获取：
  如果脚本内嵌在模板中，直接替换为：

  url: '<?php echo admin_url('admin-ajax.php'); ?>',
  

  如果是独立JS文件，需通过wp_localize_script传递URL：

  function enqueue_custom_ajax_script() {
      wp_enqueue_script('custom-ajax', get_template_directory_uri() . '/js/your-script.js', array('jquery'), '', true);
      wp_localize_script('custom-ajax', 'wp_ajax', array(
          'url' => admin_url('admin-ajax.php')
      ));
  }
  add_action('wp_enqueue_scripts', 'enqueue_custom_ajax_script');
  

  前端JS中使用wp_ajax.url作为请求地址。

3. 未登录显示后台顶部栏 #

• 检查页面是否误用了后台模板，确保使用前台模板（如page.php）
• 添加代码强制隐藏未登录用户的 admin bar：

  add_action('after_setup_theme', function() {
      if (!is_user_logged_in()) {
          show_admin_bar(false);
      }
  });
  

内容的提问来源于stack exchange，提问作者Elena Politi