3 ms·
> which includes PHP (eval() and base64_encode()) At least Python, Ruby and Perl have those functions too. The problem is not related to PHP being able to eval
by drdaeman 16y ago
> which includes PHP (eval() and base64_encode())
At least Python, Ruby and Perl have those functions too. The problem is not related to PHP being able to eval(), it's:
1. Inadequate usage of PHP as template engine, where templates are coming from untrusted sources. Think of this as very extended case of non-sanitizing user input.
2. "Dancing bunnies"-type problem. A lot of users don't understand what they are doing. They are promised they would get a nice theme, so they install it.
> can't have multiple users in the DB
Wrong, it's perfectly possible. Unless you are stuck with some god-forsaken cheap crappy LAMP hosting.
Disclaimer: I don't like PHP at all, and I try to avoid it. Experts say, and I totally agree that there are a lot of various problems in LAMP ecosystem, but they lie in very different direction.
- jacques_chester 16y ago> Wrong, it's perfectly possible. I thought so too, but in practice it doesn't work (I proposed it to them a while back). Wordpress stores database credentials as globals. Even if you gave each plugin its own permissions, they could always go straight to the superuser account for that database.