https://github.com/WordPress/WordPress/commit/3a640e1c5e39aa...

String concatenation SQL injection in the year 2026.

Oh it's even worse: https://developer.wordpress.org/plugins/creating-tables-with...

>Rather than executing an SQL query directly, we’ll use the dbDelta function

>Note that the dbDelta function is rather picky, however. For instance:

>You must put each field on its own line in your SQL statement.

>You must have two spaces between the words PRIMARY KEY and the definition of your primary key.

>You must use the key word KEY rather than its synonym INDEX and you must include at least one KEY.

>KEY must be followed by a SINGLE SPACE then the key name then a space then open parenthesis with the field name then a closed parenthesis.

>You must not use any apostrophes or backticks around field names.

>Field types must be all lowercase.

>SQL keywords, like CREATE TABLE and UPDATE, must be uppercase.

>You must specify the length of all fields that accept a length parameter. int(11), for example.

Sometimes when you write documentation for APIs you realize something is terribly designed. That should have happened here.

I like that you chose ten examples.

>> s/you must/thou shalt/g

The WordPress codebase is a disgrace. PHP is a beautiful language by now, but they absolutely butcher it and refuse to do anything about that.

It's just because they don't want to break anything in existing sites, sorta like how Microsoft doesn't generally want to break programs on Windows. So, changes are fairly incremental, and the quality is about what you'd expect from a piece of software that's decades old with no plan for what happens if it got this far.

But what do you do in that situation? If they change the structure too much, then either they make it impossible to upgrade an existing site, or potentially break a whole bunch of things said sites depend on (mostly themes and plugins). And that ease of upgrading is likely what stops a lot of people just migrating away to other solutions.

Even just introducing emulation layers for the old parts and making the new parts opt-in would be better than just giving up and keep on going. Plugin authors can choose the new subsystem as they publish updates or new plugins and themes, and in return they get speed and security guarantees.

And since the WordPress foundation controls the extension marketplace, they can reliably determine which parts of the API surface are in use, or even invest a chunk of money every month to send AI-written patches to plugin maintainers to ease the transition.

There would be so many ways to improve the situation (to the benefit of WordPress maintainers, customers, and ecosystem vendors alike, mind you!), but alas, they are stuck to their ways and will not.

> And since the WordPress foundation controls the extension marketplace, they can reliably determine which parts of the API surface are in use, or even invest a chunk of money every month to send AI-written patches to plugin maintainers to ease the transition.

What WordPress foundation?

The, uh, WordPress Foundation[0]?

[0]: https://wordpressfoundation.org

they broke tons of stuff with Gutenberg/block editor and didn't seem to be bothered by backwards compat

Not only did they break classic WordPress stuff, but they also keep breaking Gutenberg APIs at a really frustrating rate.

It’s clear that the core WordPress developers have a very different idea of project stewardship than the Gutenberg devs do.

Blame Matt Mullenweg

Fair enough. The way they added Gutenberg was a complete mess. Like yeah, the idea is a good one, and the editor can be pretty good if used correctly. But the way it was built was certainly not ideal, and was probably the worst of all worlds. Felt like someone saw SquareSpace and co, thought WordPress was falling behind and decided to push for those features to be added as quickly and inefficiently as possible.

If the existing at-risk functionality is a security issue I feel like that’s a good time to throw the proverbial flag on the play and make it an issue. Letting consumers play host to malware and phishing portals is the worse move.

[deleted]

This isn’t some problem that has developed over time. It was shit from day one.

Wordpress is a great web shell, shame it also comes with a blog

Is it? I did a project with WP a very long time ago and was kind of baffled. Like it's nice to have an good rich text editor, I got that part. But the absolute monstrosities people developed to extend WP, when they could have just used MySQL and PHP directly, astounded me. Like I couldn't figure out what WP was offering? It was just like a blog that you could painfully hack into something else if you wanted to. But even at that time there were already loads of great, batteries included PHP frameworks like Symfony or Cake. Why not just skip the painful part and code what you want directly?

Anyway, I probably shouldn't comment as maybe WP has progressed but it doesn't sound like it.

Honestly, the reasons could mostly be summed up as "we already used WordPress for the blog, we now need to add a shop onto the existing site, might as well extend the former rather than rebuild or maintain two systems".

Alternatively, folks that aren't particularly technical hacking together a solution that works 'well enough' for what they need, and agencies that only have the interest/capacity to use one platform deciding that each and every customer needs to use that platform.

If you're a skilled programmer WordPress is probably not a good solution for your issues, but if you're more of a designer or hobbyist that wants a somewhat hacky extendable blog system it's pretty easy to use.

I suspect you missed the joke: A web shell is a script to execute arbitrary commands, i.e. Remote Code Execution.

oh haha. Yea, my brain somehow interpreted shell as framework.

But yes, I agree, WP is very useful for those times when you need to run a quick `sudo rm -rf /` command but can't get to a terminal.

You may be missing the point that the WP ecosystem is aimed at non-programmers.

I'm convinced it's by design so that the community that build little businesses around wordpress still stay in the eco system. A client needs new functionality? That's be a week of work because god help anyone who wants to look into themselves.

WordPress is actively degrading the security and quality of the web I general. Has been for many many years.

The great irony is they still sport their "Code is Poetry" mantra on their website [0].

If code is poetry, Wordpress is a new genre of it, probably?

[0]: https://codex.wordpress.org/WordPress_Philosophy

Vogon Poetry [1]?

[1] https://hitchhikers.fandom.com/wiki/Vogon_poetry

Let's not insult Vogons, shall we?

If code is poetry, WordPress was written by William McGonagall <https://en.wikipedia.org/wiki/William_McGonagall>.

Wow, he wrote like if you prompted obituaries to GPT-2.

They could just go a bit more honest and migrate to "Code is pasta". WP is also closer to a pizza slice than Michelin star fine dining experience.

A pizza slice covered in pineapple [0]

[0] https://wptavern.com/wordpress-org-login-introduces-mandator...

They never said it was good poetry

Ask an old English teacher whether "poetry" implies anything favorable about quality.

[deleted]

Everything I've used from Automattic has felt that way. If you ever want to torture an engineer, just make them change the layout of WooCommerce checkout.

As a junior I am glad I happened to start working with PHP on version 7. I had some peeks at our legacy PHP5 stuff (all killed now thankfully) and it looked very different. I am sure it would suck to work with.

php7 was such a great time period for PHP, honestly lots of great experimental projects around that time too (HHVM before that, etc).

PHP 8 is good too. Lots of syntactic sugar to make your life so, so much easier.

it would help if they used strict types and modern standards but as you say the wordpress codebase is beyond dated and held together with duckt tape

I remember multiple projects giving up on rewriting it. Maybe a machine with endless patience could do it?

I've done it multiple times but no one's gonna use my off the shelf blog when there's a bagilian WordPress plugins they wanna use. But with AI you kinda sorta should just build your own blog. Doctrine with slime framework. You can even throw a WordPress plugin at the LLM and ask it to implement the same thing.

did you mean Slim, the PHP framework? When I google 'slime framework' i get some machine learning stuff

Yea

Yeah the consensus from everybody that spends some time on it seems to be: just don’t use it

> But with AI you kinda sorta should just build your own blog

Please don't. There is absolutely no reason not to use the extremely simple and powerful combination of:

* a headless CMS / static website generated, of which there are a bunch so pick the one you like the most. My go-to is Hugo but it is somewhat complex

* a static hosting service with a generous free tier like CloudFlare Pages/Workers, Netlify, Firebase Hosting, etc.

Your blog costs nothing, has zero attack surface and zero maintenance.

You happen to be on HN. Not only do I have my own blog but also my own entire ORM.

https://github.com/hparadiz/technexus

https://github.com/divergence/framework

My framework is faster than Eloquent at this point.

tbf literally all my php hate comes directly from WP

PHP is a proof that you don't need elegant or good technical solutions to be successful. You can literally pile up slop together and still be successful.

Yeah; the common idea of dignity and self-respect is to replace the duct tape with proper engineering once you're successful though, instead of just taping ever more of it on top and pretending SQL injections aren't really a problem.

...but do they truly pretend SQL injections aren't really a problem, or do they in fact promote practices and provide pathways to reduce that risk?

What they do is put lipstick on a pig! There is no need to "reduce" the risk of SQL injections when you can use a safe API that eliminates the entire error class. This is a solved problem for the rest of the world!

PHP offers that safe API, though, and always has (prepared statements). The same one as all other languages.

PHP might seem worse than other languages due to a combination of factors:

- It's the most used one by far, even though few of us like to admit it.

- Old tutorials still come up during web searches, so "SELECT * FROM `table` WHERE id = $id" will still be written today.

I think PHP came right at the time that every man and his dog was a "web developer" and writing absolute unknowledgable stuff. And PHP allowed for it.

ASP had a bit of a barrier to entry because it required all the MS. Whereas PHP was everywhere.

It was like that in the old days too. Seriously who makes a postmeta table and goes "yea let's just throw everything in here. Indexes? Meh."

I cringe everytime.

I don't think PHP is a beautiful language. If it was Laravel wouldn't need to rewrite every function from standard library. And, I see no reason to use it compared to Typescript.

I never really understood these complaints about the standard library, that's not what makes a language really. Yes, it's ugly, yes, it carries 30 years of baggage, but it's PHP the language that allows you to interact with a much more convenient abstraction layer provided by Laravel.

PHP can run the same code fully dynamically typed or with very strict type annotations, depending on your requirements. It has runtime reflection APIs that are so cheap that you don't really have to think about using them. You can do OOP or FP with PHP, or even procedural HTML-interleaved-with-PHP if that's your thing. It has late static binding, so you can defer to child classes from their parent class. There are generators and fibres as first-class language constructs now. Property hooks are an extremely clear pattern, way better than in many other languages.

Generally, there have been tons of new syntax extensions over the years, and they all slot in gracefully. With PHP 8.6, we're going to get partial application for functions, which will make PHP 8.5's match expressions one of the most ergonomic implementations I have seen yet!

Ecosystem? The JS/TS ecosystem approach is to use as many libraries as possible for the sake of it, exposing you to a massive supply chain risk. PHP doesn't suffer from that because there are barely any libraries for it.

> PHP doesn't suffer from that because there are barely any libraries for it.

You don't need many libraries in a typical project, because PHP is batteries-included and if you use a framework it does all the rest for you, that is true. But there are still hundreds of thousands of packages with billions of installs:

https://packagist.org/statistics

[flagged]

Let me convince you! :-)

There are match expressions and arrow functions:

  $slug = $title
      |> trim(...)
      |> (fn($str) => str_replace(' ', '-', $str))
      |> (fn($str) => str_replace('.', '', $str))
      |> strtolower(...);
There is meta-programming with annotations:

  final class PostsController
  {
      #[AccessControl(fn(Request $request, Post $post)
          => $request->user === $post->getAuthor()
      )]
      public function update(Request $request, Post $post): Response {
          // ...
      }
  }
Native (and optionally value-backed) enums:

  enum Status
  {
      case Draft;
      case Published;
      case Archived;
  }
Proper class property hooks, fully replacing getters and setters:

  class Data
  {
      public string $fullName {
          get => "{$this->firstName} {$this->lastName}";
          set(string $value) {
              [$first, $last] = explode(' ', $value);
              $this->firstName = $first;
              $this->lastName = $last;
          }
      }
  }
And tons of other features—among them asymmetric property visibility, fibres/green threads, DNF types, lazy object instantiation, an ever-improving yet fully opt-in static type system with runtime validation, a JIT compiler, an amazing package ecosystem and -manager, annotation-backed deprecation, and more.

> There is meta-programming with annotations:

There is, but your example is not valid. You can't use short function syntax in constant expressions, it has to be an explicit `static function`.

The reason for this, IIRC (I can't find the GitHub issue or PR atm) is that these functions aren't allowed to close over any variables, and with fn syntax doing so is implicit. Rather than erroring they've disallowed the use of arrow functions entirely.

You’re right, of course. Still I think the point stands that PHP has very powerful runtime metaprogramming features that you can build amazing abstractions on top of.

The issue isn't that they haven't added a load of modern features; it's that they never fixed the old janky broken features.

Reminds me that in the PHP5 days, there's a load of similar functions of which the parameters switch around...

Shame I forgot to add named arguments above, eliminating this problem too:

  array_map(callback: fn($i) => $i * 2, array: [10])

Looks like PHP is trying to act like Elixir. And all these are very new thing which we can't implement in wordpress because you have to care about backward compatibility.

These "very new things" have, in part, been available for more than 6 years now. Not to speak of all the other PHP features WordPress chose to forgo, like PDO with prepared statements (which completely eliminates SQL injections), which came out 21 freakin' years ago.

There are many very successful and professional PHP projects with millions of users that seem to be able to migrate to newer PHP versions just fine.

Whatever the WordPress developers are claiming are the reasons for their irresponsible codebase and their inability to improve it is nobody's fault but their own.

> Nope.

Beauty is in the eye of the beholder, and I'll disagree kindly with you on that "Nope".

What an awful fix. Does WordPress seriously still use basic string concatenation (edit: and sprintf) to build SQL queries?

To construct dynamic sql queries to have to string concatenate at least some parts, .

User data should of course be passed via prepared statements.

One usually uses "query builder" pattern for that.

Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.

ORMs and query builders ARE concatenating strings.

Not user code, no. Someone eventually has to, but virtually every ORM under the sun allows you to construct dynamic queries without having to concatenate strings yourself or resort to string interpolation.

Quick search shows this in Wordpress:

> WordPress database access abstraction class.

  class wpdb {}
So this is some sort of ORM provided.

  $results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}options WHERE option_id = 1", OBJECT );

> Some of the methods in this class take an SQL statement as input. All untrusted values in an SQL statement must be escaped to prevent SQL injection attacks. Some methods will escape SQL for you; others will not. Check the documentation to be sure before you use any method in this class. For more on SQL escaping in WordPress, see the section entitled Protect Queries Against SQL Injection Attacks below.

It does not however prevent $wpdb users from NOT binding query parameters, which leads to this vulnerability.

It seems that wpdb doesn't support placeholders for comma-separated lists, like in "WHERE id IN (?)". So the developers have to fall back to string concatenation.

WordPress source code is a mess. They should re-write it from scratch using modern technologies, or even a framework like Laravel.

That could as well just be a complete new product then, right?

It would definitely be a breaking change and unmigratable.

A few months back, Cloudflare used AI to make a Rust rewrite of WordPress, but I doubt that they would have found or corrected issues like this on the way? https://blog.cloudflare.com/emdash-wordpress/

TypeScript, not Rust.

Mullenweg will never allow WP to slip away from his control. "He wrote it" so you can't have it.

[deleted]

Who is they? automaticc?

Impossible. WordPress has had the PHP-group even considering writing new PHP features in a separate 7.4 branche and release them specifically for WP.

Ahhh very interesting! Thanks for pointing this out, I saw an attack against one of our sites this weekend using this exploit.

> data: {'requests': [{'method': 'POST', 'path': 'http://:'}, {'body': {'requests': [{'method': 'GET', 'path': 'http://:'}, {'method': 'GET', 'path': '/wp/v2/widgets?author_exclude=1%29+AND+1%3D0+UNION+ALL+SELECT+0%2C1%2C0x323...

>>Principal Software Engineer @ Bluehost. WordPress Core Committer. Baseball fan.

hmm yes, definitely. You are the principal.