2 ms·
Haha. Yeah. Moving to PDO has been on the todo list for well over a decade and keeps getting pushed back. It's hard graft to refactor all the underlying calls a
by stefdawson 6y ago
Haha. Yeah. Moving to PDO has been on the todo list for well over a decade and keeps getting pushed back. It's hard graft to refactor all the underlying calls and decide whether we want an ORM layer or not, and which to choose or roll-our-own, and then change all the places in the code that use the DB layer to do prepare-execute. And the plugin upheaval that rides its coattails.
It's one of those things that's always overlooked in the "ain't broke so don't fix it" camp. But I know it needs doing. One day...
- e12e 6y ago> change all the places in the code that use the DB layer to do prepare-execute. Take this with a big grain of salt, but I vaguely remember tp not being great at using prepared statements / safe quoting provided by the db driver - has that been improved (if it ever was a problem)? Is it easy for plug-ins to accidentally open up to sql injection?
- stefdawson 6y agoPrepared whatnow? :) Nope, we don't use them yet. Bane of my life. We rely on all core calls and plugin authors escaping content before calling our DB layer. That has to change and will be part of the move to PDO. It's just a lot of faff work and there are always shinier things to work on. I've been secretly hoping that some kind soul will do it and issue a Pull Request. But maybe I should stop being lazy, bite the bullet and do it myself!
- e12e 6y agoThank you for your candid reply. I had a nagging memory of some troubles from bugtraq or an equivalent list (mind, many, many cms and blogs had trouble with sqli..). I am a bit surprised that hasn't been (universally, permanently) fixed in the last decade, though.