3 ms·

> The Wordpress codebase [plugin api included], though, is utter garbage. I've always heard this and never actually used Wordpress myself. Has anyone ever stud

> The Wordpress codebase [plugin api included], though, is utter garbage. I've always heard this and never actually used Wordpress myself. Has anyone ever studied WHY its garbage? and how did it get to that state? is it getting better or are the latest additions and changes still garbage code?

e12e 10y ago
Popularity. WordPress is popular, php is accessible (you need notepad and an ftp client to start hacking) - combine the two, and you get a lot of "scratches my itch"-code. It probably doesn't help that WordPress is an ancient code Base with a goal of running on the cheapest webhosts (who are slow to update to newer php releases). So you get a lot of beginners that learn from messy old code, that generate more of the same. It's a mess of global and file-wide variables, an unholy mix of poorly structured procedural code married with the odd "OO" abstraction. There are good, even great php code bases - WordPress - and its plugins are not that. To be fair, WordPress itself, and the core plugins are at least somewhat consistent, and after years of security holes follow a somewhat reasonable defensive coding practice. The terror lurks in popular third-party plugins, inspired/forked from older hacks. As is evidenced by a quick look at full-disclosure where seemingly every week someone's managed to make a plugin that's broken in some novel manner. I've not been following closely lately, but for a plain php cms, one could do worse that cmsmadesimple. It's (was) pretty old-school simple php, but much simpler than something like Drupal.
- matthewking 10y ago
  The part that I didn't really understand is people accepting pull requests should be gate keepers for code quality, so amateur or not hopefully this shouldn't pollute the codebase. But you've touched on the core being reasonably decent and the real mess being with third party plugins so that makes more sense.

e12e 10y ago

Popularity. WordPress is popular, php is accessible (you need notepad and an ftp client to start hacking) - combine the two, and you get a lot of "scratches my itch"-code. It probably doesn't help that WordPress is an ancient code Base with a goal of running on the cheapest webhosts (who are slow to update to newer php releases). So you get a lot of beginners that learn from messy old code, that generate more of the same. It's a mess of global and file-wide variables, an unholy mix of poorly structured procedural code married with the odd "OO" abstraction. There are good, even great php code bases - WordPress - and its plugins are not that. To be fair, WordPress itself, and the core plugins are at least somewhat consistent, and after years of security holes follow a somewhat reasonable defensive coding practice. The terror lurks in popular third-party plugins, inspired/forked from older hacks. As is evidenced by a quick look at full-disclosure where seemingly every week someone's managed to make a plugin that's broken in some novel manner. I've not been following closely lately, but for a plain php cms, one could do worse that cmsmadesimple. It's (was) pretty old-school simple php, but much simpler than something like Drupal.

matthewking 10y ago
The part that I didn't really understand is people accepting pull requests should be gate keepers for code quality, so amateur or not hopefully this shouldn't pollute the codebase. But you've touched on the core being reasonably decent and the real mess being with third party plugins so that makes more sense.