You're right, and "think" is doing a lot of work there. Everyone wants their very own special magic guestbook plugin or some damn thing, and they're often very

You're right, and "think" is doing a lot of work there. Everyone wants their very own special magic guestbook plugin or some damn thing, and they're often very much a "my first PHP module" thing. So it's hardly surprising that they're not the best code or written with particularly safe practices in mind. Guddling about on some old disks a few months ago I found some of the very first PHP3 code I ever wrote, and it's one big SQL injection from start to finish. The 90s were a simpler time... Roughly half the 404s on the forum I run are some attempt to access WordPress admin pages, which I guess must tell us something.