I had a general question that's come from comments on my answers from experienced users on the site, see User defined password at registration - registration email sends auto generated pass and Using jQuery to delete data stored in wp_options. After reading How To Answer, my understanding was that we should answer the specific question, rather than providing ready to go copy/paste code, not that the two are mutually exclusive.

In the ajax example, @brasofilo raised a very good point, the code will simply be copy/pasted, and the suggested edits from the three experienced users reflected that. But how far does that go? In the first example, the asker posted a question about sending a user selected password via email. The answer answers that question, but as @t31os pointed out, the code is inherently unsafe as it doesn't contain sanitization or even check that the correct form fields were filled out, much less a nonce check, etc. But how far does that go? Should I be creating the initial form for the asker as well? Am I presuming too much in assuming that most developers follow best practices with form submission, db interaction sanitization and any framework specific security considerations (I guess I am)?

I guess I could just use some guidance as to how much is too much or too little when answering the question. I'd like to be, "doing it right." Thanks for any input.

4 Answers 4


My take is that while it is best to give a complete answer, and that is largely the point, as I understand it, of the Stack Exchange network-- not to provide tech support exactly but to provide working solutions to particular common problems. But that isn't always possible or practical. We work for free here and some of us actually work for real. And sometimes the questions do not have detail that allows for a complete answer.

Any answer that gets the asker going in the right direction is helpful, but do try to mention any limitations, assumptions or simplifications in your answer.


If I know there is a problem or a potential problem I will explicitly state my concerns, offer warnings, and if possible point to the steps to ameliorate the problems.

Still, effort should be made to post code is plausibly safe, at least, as evidenced by the recent attacks on WordPress sites. People do just paste code blindly.

  • 1
    That pretty much sums up my sentiments on the subject.
    – t31os
    May 3, 2013 at 17:45
  • 1
    +1. Code provided in answers is intended to be "proof-of-concept" or "example" code, not necessarily "exact, working copy pasta". Generally, questions should be asked with enough specificity to provide such "proof-of-concept" code, and if not, then the question almost certainly needs to be improved/clarified, or closed as not a real question. May 3, 2013 at 19:08
  • 5
    +1 for a proper usage of ameliorate May 3, 2013 at 21:28
  • Thanks s_ha_dum, I appreciate the response. Marking this one as accepted since Chip gave it a +1 :) May 5, 2013 at 4:35

Looking at the two specific examples you gave:

  1. The Ajax question was borderline over-broad, and would probably have been better-served with a tighter scope
  2. In both cases, the solution to the underlying problem can get lost in the details if too much "production-ready" code is added to the answer. Often, in such situations, I will add prose, or inline PHP comments to the code, indicating where data sanitization would be required, but omitted from the answer for brevity/clarity.

There is a fine balance between providing a thorough, complete answer and work for me for free on over-broad questions. If you find that your answer starts to involve more than about three steps, and if those steps are considerably unrelated to each other, that's often a signal that the scope of the original question needs to be tightened.

Likewise, there is a fine balance between using quality "example"/"proof-of-concept" code, and losing the actual answer to the actual question in the details of "production-ready" code. If more than a quarter of your example code (or, if a significant number of comments to your answer) involves corollary issues such as data sanitization, that's probably a good indication that those corollary issues should be separated from the crux of the example code.

It is a good thing to ensure due diligence that code that we know will end up as copy pasta is as quality/safe as possible, but that diligence should not distract from the primary purpose of the code: to answer the posed question.

  • Chip, thanks for your input, that clears up a lot. May 5, 2013 at 4:34

I read this thread with interest as I am new to the answering here and sometimes have trouble distinguishing between comments and answers. I just read the (Privileges) Comment Article

I made certain my (incomplete) answer didn't do any of these things:

  • Request clarification from the author;
  • Leave constructive criticism that guides the author in improving the post;
  • Add relevant but minor or transient information to a post (e.g. a link to a related question, or an alert to the author that the question has been updated).

And the answer gets moved to a comment. Isn't peer reviewing fun? LOL

  • The reason I flagged that answer as not an answer is that, while I agree completely with what you stated, and while that information is useful, as-written it didn't answer the OP's question (something that could have been accomplished using an example pre_get_posts hook callback to display a single category.) Part of the problem is that the OP didn't write an answerable question, in that the OP provided no relevant code - which precludes anyone providing specific answers to the OP's specific problem. May 8, 2013 at 13:05
  • I don't disagree with your flag. The answer I gave was borderline. When I approached the problem, I realized that the OP probably didn't know that using query_posts() is frowned upon and I pointed him in the right direction. I still thought it might be a comment, but it didn't fit the definition and that only left me with the option of using an answer. When you approached my Answer you thought, hey that's not answer, it must be a comment. May 8, 2013 at 17:17

I've just had an answer deleted and moved to a comment (here), but to me it feels like I clearly answered both parts of the original question, i.e. I gave a suggestion for a plugin (that does exactly what the OP needs), and advised that the region & status should be taxonomies. I'm not really that bothered either way, but I am curious why this is seen as a comment rather than an answer?

  • I moved that to the comments, because of the almost bare link. Without the link the only message of that post would be: I would use X. No explanation, no alternative, no code … that’s just not enough for an answer.
    – fuxia Mod
    May 12, 2013 at 1:57
  • ok thanks, makes sense, i'll bear that in mind in future. i guess in this case there's also an element of it not being that great a question. May 12, 2013 at 15:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .