11 ms·

I can see that the difficulty will be the plethora of plugins that for whatever reason won't end up being compatible, and the Wordpress community will quickly c

I can see that the difficulty will be the plethora of plugins that for whatever reason won't end up being compatible, and the Wordpress community will quickly consider SQLite a "broken database" or similar. For example, one of the most common plugins is Yoast, I'm sure somewhere in this spaghetti something will be MySQL specific. https://github.com/Yoast/wordpress-seo/blob/0efeda377ea09931e4f5c61e672b4037ed896ffc/admin/class-bulk-editor-list-table.php https://github.com/Yoast/wordpress-seo/blob/0efeda377ea09931...

retcore 4y ago
Remembering the horror that was my first encounter with a description of MySQL as a DBMS, by a far from newly minted* WordPress hosting entrepreneur, the greater difficulty may be overcoming cultural cognitive dissonance that Database != MySQL. *as a Flash website developer my friend wrote a blood insulin device graphic from spec so completely down to knowing time drift, his unintended emulation was used for regulatory approval purposes. How Oracle never capitalized on acquiring MySQL as leverage into small businesses via WordPress beggars my belief. But I'll wager that the kind of problems discussed here come into it.
Cthulhu_ 4y ago
WP could make a test suite mandatory and run tests on their hardware under their supported configurations; if it doesn't work on sqlite, it is not accepted in the plugin index. Likewise, security checks.
- dawnerd 4y ago
  They really need to force all plugins to pass the VIP phpcs rules (would need to be modified a bit). It wouldn’t be perfect but I bet it would greatly increase security. I’d also like to see them switch to git for the plugin repos.
  - desas 4y ago
    > I’d also like to see them switch to git for the plugin repos. Could you explain this idea some more? It doesn't seem related to your first suggestion. Some people just use the svn plugin repos as a release system, the actual development being done in git. There are even github actions to automate it.
- Ayesh 4y ago
  And the plugin authors would simply self-host them. Some of the top plugins available (and are linted) on WordPress.org tend to be stubs containing a lite version plus an ad, and those plugins will have less friction if they entirely self host on their own servers.
  - mgkimsal 4y ago
    Too many people doing that will mean that what you're looking for just won't be in the main (GPL?) plugin area. My own experience years ago was that for many folks, if it wasn't in there, it didn't exist. Downloading and FTPing 'out of store' plugins just wasn't something that folks wanted to get in to. Those projects may have been a minority of the overall username, but it wasn't an insignificant number of projects I knew about. Perhaps that attitude has changed in the last several years?
    - deleted 4y ago
      [deleted]
- jillesvangurp 4y ago
  Would not be a bad idea. With Github actions, doing CI builds for plugins and wordpress should be fairly easy to do with either dockerized mariadb or sqllite. Set up a little matrix build. And for good measure, maybe support nginx and posgresql as well out of the box. Nothing to incentivize plugin developers as having a few red warnings next to their name in the plugin registry. I setup builds for most of my oss projects. It's not that hard. Of course at the scale the wordpress community operates, this would require some non trivial amount of resources.
  - technion 4y ago
    Note that Wordpress don't use Github, or Git for that matter. https://core.trac.wordpress.org/browser/trunk https://core.trac.wordpress.org/browser/trunk
  - unity1001 4y ago
    Your very comment would be enough to turn off 60,000+ plugin developers and 50% of the web who uses WordPress. Nobody likes anything being forced on them there. Less, non-prominent OSS projects trying to force their way in through such arrogance.
    - axelthegerman 4y ago
      Or you could do nothing and let Wordpress rot until nobody uses it anymore. Problem solved, nothing to do for 60,000+ plugin developers.
      - unity1001 4y ago
        WordPress will surely rot if a rather-weakly adopted database engine is not forced upon its entire ecosystem. You can be sure that the flower shop owner somewhere in Idaho, who uses WooCommerce for his flower business and the random anime blogger somewhere in Tokyo, who uses WordPress for blogging, will be hampered by that.
        kzemek 4y ago
- unity1001 4y ago
  Yeah. You can be sure that 60,000+ plugin authors and 50% of the web that use WordPress and those plugins will just allow that.
  - Gordonjcp 4y ago
    Fuck 'em. The world doesn't need 60,000+ badly-written buggy insecure WordPress plugins. Adapt or die, and in WordPress's case, preferably the latter.
    - unity1001 4y ago
    - apocalyptic0n3 4y ago
      > The world doesn't need 60,000+ badly-written buggy insecure WordPress plugins. The world might not, but site operators think they do. It's the biggest appeal of the platform and why agencies have such a tough job doing non-Wordpress work. For better or worse, the simply stupid number of Wordpress plugins out there drive roughly half of all websites on the web today.
      - Gordonjcp 4y ago
        You're right, and "think" is doing a lot of work there. Everyone wants their very own special magic guestbook plugin or some damn thing, and they're often very much a "my first PHP module" thing. So it's hardly surprising that they're not the best code or written with particularly safe practices in mind. Guddling about on some old disks a few months ago I found some of the very first PHP3 code I ever wrote, and it's one big SQL injection from start to finish. The 90s were a simpler time... Roughly half the 404s on the forum I run are some attempt to access WordPress admin pages, which I guess must tell us something.
      - unity1001 4y ago
        > The world might not, but site operators think they do Well. Considering how WP is basically ~50% of all websites on the planet, that would indeed classify its 'the world' who thinks that they need those 'badly-written' (whatever that means), buggy (is there non-buggy code anywhere), insecure (any software that gets used by 50% of the Internet without security issues?) WordPress plugins. ... Really, his/her perspective just feels like a junior dev's perspective. Or the perspective of a senior dev who never had to take at least a position like a tech lead. And god forbid any kind of actual interaction with the end users in a given ecosystem.
shp0ngle 4y ago
seeing this code, I’m happy that I no longer do PHP
- 12907835202 4y ago
  "Happy you no longer do Wordpress" I work with PHP every single day and thankfully never encounter anything like this and certainly don't write it. You should see some of the C++ I see everyday. My favourite is a single 20,000 line God file called extractor_manager.cpp that merges data from MS Access and MySQL using a variety of typo'd command line arguments. Doesn't mean C++ is a bad language.
- iLoveOncall 4y ago
  The culprit is not PHP, the culprit is WordPress being developed with antiquated software engineering practises (or rather, lack of any good practice). Just take a look at their coding guidelines: https://developer.wordpress.org/coding-standards/wordpress-coding-standards/php/ https://developer.wordpress.org/coding-standards/wordpress-c... they're laughably bad and nonsensical.
  - mavhc 4y ago
    Could you explain why they're bad?
    - unity1001 4y ago
      Obviously, because s/he, the languages, stack and software he uses, his software development practices etc are all way better than the WordPress ones. Thats why they are bad. And that's why it is his language, stack and app that is 50% of all websites and 30% of all ecommerce sites in existence. Not WordPress.
      - iLoveOncall 4y ago
        So if I'm following correctly, you are saying that WordPress was successful in the first place because of its high code quality and software development practices, right? WordPress works great from a business standpoint, but it is not well made. I've spent the past month developing plugins for my own WordPress website, and it is laughable how bad it is. I mean, the official advice to understanding things is not to read their documentation, it's "look through the code lol" [1]. It's probably fair, since their documentation is so bad it does not explain what any of the parameters of the functions are most of the time, accepting a map that you don't know the possible values of unless you read their code. And, well, that code was probably okay in 2005, but it's hot garbage in 2022. [1] https://developer.wordpress.org/plugins/hooks/filters/#add-filter https://developer.wordpress.org/plugins/hooks/filters/#add-f...
liotier 4y ago
Should the creation of prepared statement be shifted down from that code to adaptation layer between it and each database's library ?
weird-eye-issue 4y ago
I was expecting some really esoteric SQL used in that file but the most advanced query I see contains a subquery with a union. Does SQLite not support these basic features?
- technion 4y ago
  I didn't spend time looking for specific features, as much as pointing out the standard is to be extremely hand wrangled and therefore prone to such issues. I have no idea if this sort of nonsense (this is an official Automattic plugin) is going to work in SQLite: https://github.com/Automattic/jetpack/blob/2447e267e40f2d133a5c15c2320b776e4c395ec8/projects/plugins/vaultpress/class.vaultpress-database.php#L160 https://github.com/Automattic/jetpack/blob/2447e267e40f2d133... But certainly creating a new table with ENGINE= which you can also find in that file isn't likely to work as intended on other platforms.
  - dncornholio 4y ago
    "This sort of nonsense". I don't think you know what this plugin is actually doing, but it seems to be a backup plugin. So I don't think seeing MySQL specific stuff there is worth mentioning. I think you're trying a little bit too hard buddy
rmccue 4y ago
One of the people cited as being involved in the discussion at WCEU (a major WordPress conference) is Joost de Valk, the creator of Yoast (and currently interim CTO of Yoast). I would suspect if any plugin invests in making sure it's compatible, it'll be Yoast SEO. :)
billpg 4y ago
Those plugins that don't work with SQLite will be replaced with plugins that do.

retcore 4y ago

Remembering the horror that was my first encounter with a description of MySQL as a DBMS, by a far from newly minted* WordPress hosting entrepreneur, the greater difficulty may be overcoming cultural cognitive dissonance that Database != MySQL. *as a Flash website developer my friend wrote a blood insulin device graphic from spec so completely down to knowing time drift, his unintended emulation was used for regulatory approval purposes. How Oracle never capitalized on acquiring MySQL as leverage into small businesses via WordPress beggars my belief. But I'll wager that the kind of problems discussed here come into it.

Cthulhu_ 4y ago

WP could make a test suite mandatory and run tests on their hardware under their supported configurations; if it doesn't work on sqlite, it is not accepted in the plugin index. Likewise, security checks.

dawnerd 4y ago
They really need to force all plugins to pass the VIP phpcs rules (would need to be modified a bit). It wouldn’t be perfect but I bet it would greatly increase security. I’d also like to see them switch to git for the plugin repos.
- desas 4y ago
  > I’d also like to see them switch to git for the plugin repos. Could you explain this idea some more? It doesn't seem related to your first suggestion. Some people just use the svn plugin repos as a release system, the actual development being done in git. There are even github actions to automate it.
Ayesh 4y ago
And the plugin authors would simply self-host them. Some of the top plugins available (and are linted) on WordPress.org tend to be stubs containing a lite version plus an ad, and those plugins will have less friction if they entirely self host on their own servers.
- mgkimsal 4y ago
  Too many people doing that will mean that what you're looking for just won't be in the main (GPL?) plugin area. My own experience years ago was that for many folks, if it wasn't in there, it didn't exist. Downloading and FTPing 'out of store' plugins just wasn't something that folks wanted to get in to. Those projects may have been a minority of the overall username, but it wasn't an insignificant number of projects I knew about. Perhaps that attitude has changed in the last several years?
  - deleted 4y ago
    [deleted]
jillesvangurp 4y ago
Would not be a bad idea. With Github actions, doing CI builds for plugins and wordpress should be fairly easy to do with either dockerized mariadb or sqllite. Set up a little matrix build. And for good measure, maybe support nginx and posgresql as well out of the box. Nothing to incentivize plugin developers as having a few red warnings next to their name in the plugin registry. I setup builds for most of my oss projects. It's not that hard. Of course at the scale the wordpress community operates, this would require some non trivial amount of resources.
- technion 4y ago
  Note that Wordpress don't use Github, or Git for that matter. https://core.trac.wordpress.org/browser/trunk https://core.trac.wordpress.org/browser/trunk
- unity1001 4y ago
  Your very comment would be enough to turn off 60,000+ plugin developers and 50% of the web who uses WordPress. Nobody likes anything being forced on them there. Less, non-prominent OSS projects trying to force their way in through such arrogance.
  - axelthegerman 4y ago
    Or you could do nothing and let Wordpress rot until nobody uses it anymore. Problem solved, nothing to do for 60,000+ plugin developers.
    - unity1001 4y ago
      WordPress will surely rot if a rather-weakly adopted database engine is not forced upon its entire ecosystem. You can be sure that the flower shop owner somewhere in Idaho, who uses WooCommerce for his flower business and the random anime blogger somewhere in Tokyo, who uses WordPress for blogging, will be hampered by that.
      - kzemek 4y ago
unity1001 4y ago
Yeah. You can be sure that 60,000+ plugin authors and 50% of the web that use WordPress and those plugins will just allow that.
- Gordonjcp 4y ago
  Fuck 'em. The world doesn't need 60,000+ badly-written buggy insecure WordPress plugins. Adapt or die, and in WordPress's case, preferably the latter.
  - unity1001 4y ago
  - apocalyptic0n3 4y ago
    > The world doesn't need 60,000+ badly-written buggy insecure WordPress plugins. The world might not, but site operators think they do. It's the biggest appeal of the platform and why agencies have such a tough job doing non-Wordpress work. For better or worse, the simply stupid number of Wordpress plugins out there drive roughly half of all websites on the web today.
    - Gordonjcp 4y ago
      You're right, and "think" is doing a lot of work there. Everyone wants their very own special magic guestbook plugin or some damn thing, and they're often very much a "my first PHP module" thing. So it's hardly surprising that they're not the best code or written with particularly safe practices in mind. Guddling about on some old disks a few months ago I found some of the very first PHP3 code I ever wrote, and it's one big SQL injection from start to finish. The 90s were a simpler time... Roughly half the 404s on the forum I run are some attempt to access WordPress admin pages, which I guess must tell us something.
    - unity1001 4y ago
      > The world might not, but site operators think they do Well. Considering how WP is basically ~50% of all websites on the planet, that would indeed classify its 'the world' who thinks that they need those 'badly-written' (whatever that means), buggy (is there non-buggy code anywhere), insecure (any software that gets used by 50% of the Internet without security issues?) WordPress plugins. ... Really, his/her perspective just feels like a junior dev's perspective. Or the perspective of a senior dev who never had to take at least a position like a tech lead. And god forbid any kind of actual interaction with the end users in a given ecosystem.

shp0ngle 4y ago

seeing this code, I’m happy that I no longer do PHP

12907835202 4y ago
"Happy you no longer do Wordpress" I work with PHP every single day and thankfully never encounter anything like this and certainly don't write it. You should see some of the C++ I see everyday. My favourite is a single 20,000 line God file called extractor_manager.cpp that merges data from MS Access and MySQL using a variety of typo'd command line arguments. Doesn't mean C++ is a bad language.
iLoveOncall 4y ago
The culprit is not PHP, the culprit is WordPress being developed with antiquated software engineering practises (or rather, lack of any good practice). Just take a look at their coding guidelines: https://developer.wordpress.org/coding-standards/wordpress-coding-standards/php/ https://developer.wordpress.org/coding-standards/wordpress-c... they're laughably bad and nonsensical.
- mavhc 4y ago
  Could you explain why they're bad?
  - unity1001 4y ago
    Obviously, because s/he, the languages, stack and software he uses, his software development practices etc are all way better than the WordPress ones. Thats why they are bad. And that's why it is his language, stack and app that is 50% of all websites and 30% of all ecommerce sites in existence. Not WordPress.
    - iLoveOncall 4y ago
      So if I'm following correctly, you are saying that WordPress was successful in the first place because of its high code quality and software development practices, right? WordPress works great from a business standpoint, but it is not well made. I've spent the past month developing plugins for my own WordPress website, and it is laughable how bad it is. I mean, the official advice to understanding things is not to read their documentation, it's "look through the code lol" [1]. It's probably fair, since their documentation is so bad it does not explain what any of the parameters of the functions are most of the time, accepting a map that you don't know the possible values of unless you read their code. And, well, that code was probably okay in 2005, but it's hot garbage in 2022. [1] https://developer.wordpress.org/plugins/hooks/filters/#add-filter https://developer.wordpress.org/plugins/hooks/filters/#add-f...

liotier 4y ago

Should the creation of prepared statement be shifted down from that code to adaptation layer between it and each database's library ?

weird-eye-issue 4y ago

I was expecting some really esoteric SQL used in that file but the most advanced query I see contains a subquery with a union. Does SQLite not support these basic features?

technion 4y ago
I didn't spend time looking for specific features, as much as pointing out the standard is to be extremely hand wrangled and therefore prone to such issues. I have no idea if this sort of nonsense (this is an official Automattic plugin) is going to work in SQLite: https://github.com/Automattic/jetpack/blob/2447e267e40f2d133a5c15c2320b776e4c395ec8/projects/plugins/vaultpress/class.vaultpress-database.php#L160 https://github.com/Automattic/jetpack/blob/2447e267e40f2d133... But certainly creating a new table with ENGINE= which you can also find in that file isn't likely to work as intended on other platforms.
- dncornholio 4y ago
  "This sort of nonsense". I don't think you know what this plugin is actually doing, but it seems to be a backup plugin. So I don't think seeing MySQL specific stuff there is worth mentioning. I think you're trying a little bit too hard buddy

rmccue 4y ago

One of the people cited as being involved in the discussion at WCEU (a major WordPress conference) is Joost de Valk, the creator of Yoast (and currently interim CTO of Yoast). I would suspect if any plugin invests in making sure it's compatible, it'll be Yoast SEO. :)

billpg 4y ago

Those plugins that don't work with SQLite will be replaced with plugins that do.