Snippet Types: PHP, JS, CSS, and HTML

GOCSM supports four snippet types. Choose the type that matches what your code does.

PHP #

PHP snippets run on the server. Use PHP when you need to:

• Hook into WordPress actions or filters.
• Modify post data, user capabilities, or query results.
• Register custom post types, taxonomies, or shortcodes.
• Interact with the database or external APIs from the server side.

PHP snippets are written to wp-content/uploads/gocsm/snippets/ as .php files and loaded via require_once on the hook you specify in the Scope card. Before loading, GOCSM verifies the generated file still matches the hash stored when the file was generated.

The file always begins with if (!defined('ABSPATH')) { exit; } to prevent direct HTTP access.

How PHP snippet code runs #

GOCSM loads each PHP snippet once per request, inside a function scope of its own. The same rules apply whether the snippet loads from its generated file or through eval fallback:

• Top-level variables are local to the snippet. A variable you assign at the top of a snippet is not a global, and other snippets, themes, and plugins cannot see it. Config-block values are top-level variables too. The only variable already defined when your code starts is the one GOCSM uses to load it ($gocsm_file, or $gocsm_code under eval fallback); don’t rely on it.

• Pass variables into callbacks explicitly. A callback you register with add_action() or add_filter() runs later, outside the snippet’s scope. Give it what it needs with use:

  $form_id = 5;
  
  add_filter( 'gform_pre_render', function ( $form ) use ( $form_id ) {
      // $form_id is available here.
      return $form;
  } );

• Use global for real globals. To read or set a WordPress global such as $wpdb or $post, declare it with global $wpdb; first, as you would inside any function.

• There is no $this. Snippet code does not run inside an object.

• Functions and classes are global. Named functions and classes you declare are available everywhere, so give them a unique prefix. Declaring a name that already exists is a fatal error.

• Mind the hook you load on. The snippet’s own code runs when its Scope hook fires. A callback you add to that same hook only runs if its priority is later than the snippet’s priority; otherwise use a later hook.

• return at the top level simply ends the snippet for that request.

JavaScript #

JS snippets are enqueued as external script files. Use JS when you need to:

• Add interactivity to the frontend or admin.
• Interact with browser APIs.
• Extend third-party JavaScript libraries.

JS snippets are written to wp-content/uploads/gocsm/js/ and enqueued via wp_enqueue_script. You control whether they load in the head or footer, and whether to use defer, async, or blocking script loading.

CSS #

CSS snippets are enqueued as external stylesheets. Use CSS when you need to:

• Override theme styles.
• Add custom styling for forms, widgets, or admin screens.

CSS snippets are written to wp-content/uploads/gocsm/css/ and enqueued via wp_enqueue_style. You can specify a media query (default: all).

HTML #

HTML snippets print markup into the page. Use HTML when you need to:

• Add a tracking or verification tag to the page head.
• Insert a banner, notice, or widget markup at the start of the body or in the footer.
• Reuse a block of markup inside posts and pages with a shortcode or the HTML Snippet block.

Each HTML snippet prints at the location you choose in the Scope card: the head, the start of the body, or the footer of front-end pages, admin screens, or the login page. Every active HTML snippet can also be placed anywhere shortcodes work with [gocsm_snippet id="123"]; the shortcode is shown in the Scope card once the snippet is saved. In the block editor, add the HTML Snippet block and choose the snippet from its list. Choose Shortcode only as the location for markup that should appear only where you place the shortcode or block.

The markup is printed exactly as written. It is not run as PHP, and HTML snippets have no config block. Markup can include <script> and <style> tags.

HTML snippets are written to wp-content/uploads/gocsm/html/. The files are stored as .php files that stop before the markup, so requesting one directly returns nothing. Before printing, GOCSM verifies the file still matches the hash stored when it was generated; if it does not, the snippet moves to Error and prints nothing.

When you save, GOCSM checks the markup for tags that are never closed or closed without being opened, and shows a warning. The warning does not stop the save, because a fragment printed into the head can be intentionally partial.

Changing type #

Custom snippets can be changed between PHP, JavaScript, CSS, and HTML from the edit screen. GitHub-sourced snippets use the type declared in snippets.json; that field is read-only in the admin UI and changes only when the upstream manifest changes.