tml_ms_signup_handler()

function tml_ms_signup_handler() {
    // phpcs:disable WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- mirrors wp-signup.php's own signup-processing, which is a public unauthenticated form with no nonce.

    if ( is_array( get_site_option( 'illegal_names' ) ) && isset( $_GET['new'] ) && in_array( $_GET['new'], get_site_option( 'illegal_names' ), true ) ) {
        wp_redirect( network_home_url() ); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- target is always network_home_url(), not user-controlled; matches wp-signup.php's own use of plain wp_redirect() here.
        exit;
    }

    if ( ! is_multisite() ) {
        wp_redirect( wp_registration_url() ); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- target is always wp_registration_url(), not user-controlled; matches wp-signup.php's own use of plain wp_redirect() here.
        exit;
    }

    if ( ! is_main_site() ) {
        /**
         * Filter whether to redirect subsite signup to network signup or not.
         *
         * @since 7.1.4
         *
         * @param bool $redirect Whether to redirect or not. Default true.
         */
        if ( apply_filters( 'tml_redirect_subsite_to_network_signup', true ) ) {
            wp_redirect( network_site_url( 'wp-signup.php' ) ); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- target is always network_site_url( 'wp-signup.php' ), not user-controlled; matches wp-signup.php's own use of plain wp_redirect() here.
            exit;
        }
    }

    $active_signup = tml_ms_signup_get_active_signup();

    $newblogname = isset( $_GET['new'] ) ? strtolower( preg_replace( '/^-|-$|[^-a-zA-Z0-9]/', '', $_GET['new'] ) ) : null;

    if ( 'none' === $active_signup || ( 'blog' === $active_signup && ! is_user_logged_in() ) ) {
        return;
    }

    $stage = isset( $_POST['stage'] ) ? $_POST['stage'] : 'default';

    if ( 'default' !== $stage ) {
        add_filter( 'wpmu_validate_user_signup', 'tml_ms_signup_nonce_check' );
        add_filter( 'wpmu_validate_blog_signup', 'tml_ms_signup_nonce_check' );
    }

    switch ( $stage ) {
        case 'validate-user-signup':
            if ( 'all' === $active_signup
                || ( 'blog' === $_POST['signup_for'] && 'blog' === $active_signup )
                || ( 'user' === $_POST['signup_for'] && 'user' === $active_signup )
            ) {
                $result     = wpmu_validate_user_signup( $_POST['user_name'], $_POST['user_email'] );
                $user_name  = $result['user_name'];
                $user_email = $result['user_email'];
                $errors     = $result['errors'];

                tml_set_data( 'signup_result', $result );

                if ( $errors->get_error_code() ) {
                    tml_set_data( 'signup_form', 'user' );
                    return;
                }

                if ( 'blog' === $_POST['signup_for'] ) {
                    tml_set_data( 'signup_form', 'blog' );
                    return;
                }

                /** This filter is documented in wp-signup.php */
                wpmu_signup_user( $user_name, $user_email, apply_filters( 'add_signup_meta', array() ) );
            }
            break;

        case 'validate-blog-signup':
            if ( 'all' === $active_signup || 'blog' === $active_signup ) {
                $user_result = wpmu_validate_user_signup( $_POST['user_name'], $_POST['user_email'] );
                $user_name   = $user_result['user_name'];
                $user_email  = $user_result['user_email'];
                $user_errors = $user_result['errors'];

                tml_set_data( 'signup_user_result', $user_result );

                if ( $user_errors->get_error_code() ) {
                    tml_set_data( 'signup_form', 'user' );
                    return;
                }

                $result     = wpmu_validate_blog_signup( $_POST['blogname'], $_POST['blog_title'] );
                $domain     = $result['domain'];
                $path       = $result['path'];
                $blogname   = $result['blogname'];
                $blog_title = $result['blog_title'];
                $errors     = $result['errors'];

                tml_set_data( 'signup_result', $result );

                if ( $errors->get_error_code() ) {
                    tml_set_data( 'signup_form', 'blog' );
                    return;
                }

                $public      = (int) $_POST['blog_public'];
                $signup_meta = array(
                    'lang_id' => 1,
                    'public'  => $public,
                );

                // Handle the language setting for the new site.
                if ( ! empty( $_POST['site_language'] ) ) {
                    $languages = tml_ms_signup_get_available_languages();
                    if ( in_array( $_POST['site_language'], $languages, true ) ) {
                        $language = wp_unslash( sanitize_text_field( $_POST['site_language'] ) );
                        if ( $language ) {
                            $signup_meta['WPLANG'] = $language;
                        }
                    }
                }

                /** This filter is documented in wp-signup.php */
                $meta = apply_filters( 'add_signup_meta', $signup_meta );

                wpmu_signup_blog( $domain, $path, $blog_title, $user_name, $user_email, $meta );
            }
            break;

        case 'gimmeanotherblog':
            if ( ! is_user_logged_in() ) {
                die;
            }

            if ( 'all' !== $active_signup && 'blog' !== $active_signup ) {
                return;
            }

            $current_user = wp_get_current_user();

            $result     = wpmu_validate_blog_signup( $_POST['blogname'], $_POST['blog_title'], $current_user );
            $domain     = $result['domain'];
            $path       = $result['path'];
            $blogname   = $result['blogname'];
            $blog_title = $result['blog_title'];
            $errors     = $result['errors'];

            tml_set_data( 'signup_result', $result );

            if ( $errors->get_error_code() ) {
                tml_set_data( 'signup_form', 'another_blog' );
                return;
            }

            $public             = (int) $_POST['blog_public'];
            $blog_meta_defaults = array(
                'lang_id' => 1,
                'public'  => $public,
            );

            // Handle the language setting for the new site.
            if ( ! empty( $_POST['site_language'] ) ) {

                $languages = tml_ms_signup_get_available_languages();

                if ( in_array( $_POST['site_language'], $languages, true ) ) {
                    $language = wp_unslash( sanitize_text_field( $_POST['site_language'] ) );

                    if ( $language ) {
                        $blog_meta_defaults['WPLANG'] = $language;
                    }
                }
            }

            /** This filter is documented in wp-signup.php */
            $meta_defaults = apply_filters( 'signup_create_blog_meta', $blog_meta_defaults );

            /** This filter is documented in wp-signup.php */
            $meta = apply_filters( 'add_signup_meta', $meta_defaults );

            $blog_id = wpmu_create_blog( $domain, $path, $blog_title, $current_user->ID, $meta, get_current_network_id() );

            tml_set_data( 'signup_blog_id', $blog_id );
            break;

        case 'default':
        default:
            do_action( 'preprocess_signup_form' );
            break;
    }
    // phpcs:enable WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
}

View src/includes/ms-functions.php, line 549 on GitHub