2 ms·
Those problems are not inherent to PHP (directly), but to WP not using any sort of (intentionally capability-limited) templating system. A design flaw - because
by drdaeman 16y ago
Those problems are not inherent to PHP (directly), but to WP not using any sort of (intentionally capability-limited) templating system. A design flaw - because probably WP devs never considered templates would be provided by untrusted sources.
The (painful) solution is to throw away current templating approach, and use some template engine instead. A bit less painful solution would be a compiler from some restricted language to current PHP-based templates, and declaring current approach deprecated, warning users of problems and highly discouraging them from using any untrusted PHP code.
- ionfish 16y agoI don't think you can blame the templating system when the plugin system is vulnerable to precisely the same issues, namely arbitrary code execution—except, of course, that the attack profile is so much broader for plugins since people will only have one template running (or two if they're using a child theme), but typically, many plugins.