TableOn

TABLEON_Default::action() returns the profile: for every key a title, an 'action' closure that renders the cell, and for filterable keys get_filter_query_args and get_filter_draw_data. get_table_data() loops over requested fields and calls $profile[$field]['action'] only when the key exists, so an unknown field name is ignored. Every row also carries pid, which cell actions on the front use.

assemble_meta_for_system() turns a row of the meta table into a profile entry. Text uses LIKE and a text input. Number uses BETWEEN with type numeric from a 'min:max' value, a range slider and meta_value_num ordering. Calendar compares either as a unix timestamp (numeric) or as DATETIME, chosen per field, because plugins such as ACF store date strings while others store timestamps.

Ordering by post_status is done with a closure hooked to posts_orderby for the duration of one WP_Query and removed afterwards, so it does not leak into other queries on the page. Sort-by drop-down values such as title-desc or <meta_key>-desc are mapped to orderby/order, with meta_value_num for meta fields typed as number.

Each table can store rules: post IDs, excluded IDs, authors, terms to include or exclude. get_table_data() applies them before the visitor's filters, with IDs cast to integers. A shortcode attribute author=N is folded into the same rules (code comment dated 16-09-2020).

Columns are rows with table_id, field_key, pos_num, is_active, show_on_mobile and JSON options, indexed on table_id and is_active, so a table's active columns are one indexed query. The whole configuration exports as one JSON document; import truncates each table and reinserts rows, behind a role check.

The searchable columns come from the shortcode attribute tableon_text_search_by but are filtered to post_title, post_content and post_excerpt, so a column name never reaches SQL from outside the list. The term is lower-cased with a multibyte-aware helper, escaped with esc_like() and bound with $wpdb->prepare().

get_field_drawing_data() uses the stored min/max of the table when set; otherwise it queries wp_postmeta for the key with a numeric cast, so text-stored numbers compare as numbers. Comment count bounds are MIN/MAX over wp_posts of the table's post type.

draw_filter_form_data() duplicates a calendar field as <key>---to with 'From:' and 'To:' labels. The key does not exist in the profile, so provider() recognizes the suffix, strips it and calls the original field's query builder with is_calendar_dir_to = true, which flips >= to <=.

The mselect-logic option is read from the table's filter options and replaced by IN if it is not one of IN, NOT IN, AND. Term IDs go into tax_query by term_id.

build_taxonomy_tree() walks terms parent by parent, skips excluded IDs, keeps only included IDs when that list is set, and prefixes titles with one dash per level so a flat select shows the hierarchy. It runs one get_terms() call per parent with hide_empty.

The request names a filter provider; get_table_data() passes the query args, filter data and shortcode args through the matching filter. The built-in form is the 'default' provider. Taxonomy Chain Menu uses the client side of this, writing filter_data into the table and asking it to redraw.

Each ajax request stores its AbortController; a new request aborts the pending one first, so only the latest page, sort or filter state is drawn.

In json mode the rows come embedded in the page. Title search, count, ORDER BY and LIMIT/OFFSET are built as SQL strings and run by AlaSQL over the in-memory array, so paging and sorting need no requests.

to_json starts as ajax with a switch flag. After the first response the rows are kept as table_data and the mode becomes json. On the server json modes request all matching posts (posts_per_page = -1), which the code marks as a memory risk, so the mode suits small and medium sets.

set_cache() and get_cache() key responses by __hash_object(request_data), a string hash over JSON.stringify of the whole request (page, order, filters). Going back to a page already seen is served from memory. Cache is off in json, to_json and load-more modes, where data is local anyway.

Below compact_view_width rows are drawn as stacked cells and headers are hidden. The resize handler redraws only when the compact state actually changes and locks itself for 999 ms between runs. Columns can be dropped on mobile (hide_on_mobile) or hidden below a pixel width by generated @media rules. Rows are built in a DocumentFragment and inserted once.

get_theme_css() loads the skin from the theme's tableon-skins folder first, then from the plugin, replaces tid with the table's HTML id, strips comments and whitespace. Per-column styles and the table's custom CSS are prefixed with #<table id> as well, so one table's rules do not touch another.

A request with tableon-remote-page and anchor returns JavaScript instead of a page: settings as variables plus remote.js, which creates a lazy-loaded iframe in the given container. The page inside uses a blank template the plugin registers, so the theme chrome is not shown.

Table settings and, in json mode, all rows are printed into the page. Encoding <, >, quotes and & as unicode escapes means post titles or meta values cannot close the element or inject markup.

TABLEON_Vocabulary reads the whole table once into a static array; get() returns the value for the current locale or the original string. The current language passes through the tableon_current_lang filter, which also switches WPML, so ajax requests render in the visitor's language.

Admin screens register only for users who pass can_manage_data(), which accepts administrators and roles listed in the user_roles_can setting. Save, create and delete handlers each verify the 'tableon' nonce.