Get Top 10 Purchases from all users of my woocommerce shop

Question

im playing around with some querys and I just created a shortcode which does get me the top 10 purchases in my woocommerce shop and displays name price and ranking in a list. It works perfectly fine, but I have no idea if it is best practise and/or safe. Can somebody confirm my solution and/or edit it?

Thanks in advance!

function topranking(){

    // WOOCOMMERCE QUERY TOP 10
    $query   = new WC_Order_Query( array(
        'limit'      => 10,
        'orderby'    => 'price',
        'status'     => 'completed',
        'order'      => 'DESC',
        'return'     => 'ids',
    ) );
    $orders  = $query->get_orders();

    $total_amount = array();
    $count = 0;

    foreach ( $orders as $order_id ) {
        $order                            = wc_get_order( $order_id );
        $total_amount[ $order_id ]        = $order->get_total();
        $billing_first_name [ $order_id ] = $order->get_billing_first_name();
        $billing_last_name  [ $order_id ] = $order->get_billing_last_name();
        $count++;
        ?>
            <p><?php echo $count ?></p>
            <p><?php echo $total_amount[ $order_id ] ?></p>
            <p><?php echo $billing_first_name [ $order_id ] ?></p>
            <p><?php echo $billing_last_name [ $order_id ] ?></p>      
        <?php
    }
 }
add_shortcode('top', 'topranking');

Answer 1

There's two things.

1. Note that the function called by the shortcode should never produce an output of any kind. Shortcode functions should return the text that is to be used to replace the shortcode.

2. escape your output.

<?php
function topranking(){

    // WOOCOMMERCE QUERY TOP 10
    $query   = new WC_Order_Query( array(
        'limit'      => 10,
        'orderby'    => 'price',
        'status'     => 'completed',
        'order'      => 'DESC',
        'return'     => 'ids',
    ) );
    $orders  = $query->get_orders();

    $total_amount = array();
    $count = 0;
    // If you want to echo your output... use output buffering
    ob_start();
    foreach ( $orders as $order_id ) {
        $order                            = wc_get_order( $order_id );
        $total_amount[ $order_id ]        = $order->get_total();
        $billing_first_name [ $order_id ] = $order->get_billing_first_name();
        $billing_last_name  [ $order_id ] = $order->get_billing_last_name();
        $count++;
        ?>
        <p><?php echo esc_html($count); ?></p>
        <p><?php echo esc_html($total_amount[ $order_id ]); ?></p>
        <p><?php echo esc_html($billing_first_name [ $order_id ]); ?></p>
        <p><?php echo esc_html($billing_last_name [ $order_id ]); ?></p>
        <?php
    }
    // Return shortcode output.
    return ob_get_clean();
}
add_shortcode('top', 'topranking');

or using concatenation

function topranking() {

    // WOOCOMMERCE QUERY TOP 10
    $query = new WC_Order_Query( array(
        'limit'   => 10,
        'orderby' => 'price',
        'status'  => 'completed',
        'order'   => 'DESC',
        'return'  => 'ids',
    ) );
    $orders = $query->get_orders();
    $total_amount = array();
    $count = 0;
    // Instead of output buffer - set $output to empty string
    $output = '';
    foreach ( $orders as $order_id ) {
        $order = wc_get_order( $order_id );
        $total_amount[$order_id] = $order->get_total();
        $billing_first_name [$order_id] = $order->get_billing_first_name();
        $billing_last_name  [$order_id] = $order->get_billing_last_name();
        $count++;

        $output .= '<p>' . esc_html( $count ) . '</p>';
        $output .= '<p>' . esc_html( $total_amount[$order_id] ) . '</p>';
        $output .= '<p>' . esc_html( $billing_first_name [$order_id] ) . '</p>';
        $output .= '<p>' . esc_html( $billing_last_name [$order_id] ) . '</p>';
        
    }
    // Return shortcode output.
    return $output;
}

add_shortcode( 'top', 'topranking' );