5 ms·

Just reading this again gives me a backflash of the horrors of working with WordPress. If you haven’t seen the source, you don’t know just how god-awful the cod

by 9dev 4y ago

Just reading this again gives me a backflash of the horrors of working with WordPress. If you haven’t seen the source, you don’t know just how god-awful the code is - and it just won’t die, because of all the ecosystem traction it has. Even the PHP developers have chosen to ignore WordPress in language evolution considerations, as the WordPress community refuses to do accept kind of progress for their project - they still use the unsafe, outdated mysql-API without parametrised queries, for example. Whatever you do in 2023—if you can avoid it, don’t use WordPress as a CMS.

mpol 4y ago
WordPress uses the PHP-mysqli extension. The PHP-mysql extension is unused since WordPress 3.9, quite some years ago. You might mean PHP-pdo is advised. Can you explain why it is better in this regard? Also $wpdb->prepare() uses parametrised values. Not everywhere in WordPress core is it being used. Most plugins use it for direct queries (not that common), but I don't know if the plugin team refuses plugins when they are not using it.
- 9dev 4y ago
  Read this article for a primer on why PDO is a vastly better choice: https://phpdelusions.net/pdo#why https://phpdelusions.net/pdo#why And the fact that it’s 2023 and we’re somehow ok with the biggest web application there is not using parametrised queries in its core completely stumps me. Time and time again, SQL injection attacks in Wordpress or it’s plugins pop up. PDO with parametrised queries simply eliminates this issue.
  - luckylion 4y ago
    > PDO with parametrised queries simply eliminates this issue. True, but plugin authors not caring about using them is the primary issue, and that doesn't change just because wpdb uses a different API under the hood.
    - 9dev 4y ago
      No, but nobody will encourage them to. Wordpress has fostered an ecosystem of bad practices that is mostly resistant to change.
- tyingq 4y ago
  >Also $wpdb->prepare() uses parametrised values. They appear to be a hand-rolled PHP version of imitation client-side parameterized values, not the actual database library ones. https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wpdb.php#L1494 https://github.com/WordPress/WordPress/blob/master/wp-includ...
  - berkle4455 4y ago
    Wow. That is so much code just to avoid calling mysqli_prepare(). And they insist on using a weird printf inspired syntax instead of ? or :field.
    - tyingq 4y ago
      I suppose it's pretty battle-hardened by now, but I'd be afraid to ever touch that code for fear of introducing a SQL injection.
kijin 4y ago
There's much more to WordPress than the ecosystem. If we just think of it as a legacy tool that is only limping along because of the plugins, we will forever be perplexed that it continues to exist. WordPress is the FLOSS alternative to Wix et al. It is the only practical software that enables people to create and self-host an online presence without having to type a single line of code, and without being beholden to a large centralized platform. No, a static site generator that requires knowledge of Markdown and a few lines of bash doesn't count. A CMS that requires you to hire a professional to even get started doesn't count, either. It might seem strange to developers like us, but there are lots of people out there who are simply allergic to code. They can use PowerPoint and maybe even Photoshop, but show them a blank terminal and they'll just freeze. WordPress, on the other hand, can be navigated with a bunch of point-and-click, drag-and-drop, buy this and add that and change the options a bit. Just like PowerPoint, it barely works, but it works. Very few people in our startup bubble seem to care about these "I want a website, but no code please" people, and when we do we often treat them with contempt. How hard can it be to copy and execute a few commands, after all? But apparently that market is large enough to attract a sustainable ecosystem of plugin and theme sellers. WordPress has this market completely cornered. It won't magically disappear just because it's built in crappy code. Understand the users, on the other hand, build a good alternative, and that billion-dollar market might become yours. :)
- DoctorOW 4y ago
  > Understand the users, on the other hand, build a good alternative, and that billion-dollar market might become yours. Isn't that the entire point of Ghost?
  - kijin 4y ago
    The installation guide for self-hosted Ghost assumes that you have at least a virtual private server, and gives you a bunch of commands to type into a root shell. By that time, you've already lost 90% of the people who would have chosen WordPress.
    - MonaroVXR 4y ago
sdze 4y ago
Why would you change a successful product just because the "language evolves"? PHP is so successful precisely because it lets all the legacy code live. To the contrary, with each PHP iteration, "bad code" is executed faster with fewer energy utilized.
- 9dev 4y ago
  It’s not because the language evolves - which it does - but because Wordpress is built on bad patterns, abuse of legacy features, and simply heaps upon heaps of bad code. This leads to PHP itself having to make bad compromises for the future to keep the Wordpress code of millions of websites running; this leads to developers wasting time trying to accommodate Wordpress in plugins and themes; this leads to new developers growing up with bad standards and outdated practices. I’m not complaining Wordpress doesn’t follow the latest trends or won’t add arrow functions everywhere. I’m complaining they actively block the way to the future, like a senile senator with lots of unmerited influence and decade-old opinions.
dageshi 4y ago
There's no clear cut alternative CMS to use, that's the issue. If you own a wordpress site for your business and you want to change your dev or agency then you will have no problems finding people who understand WP and can work on/fix your site. It might cost you but you'll have no issues finding people to work on it. Use anything else and you'll be hunting down people who can and want to work on it. The other major issue is, the paid plugin ecosystem is vast in wordpress and because of that many problems can be solved with a plugin. The conversation typically goes "If this were on wordpress we'd buy this plugin for $xx and we'd be done in a few days, but it's not so we can build it for $xxxx and it'll take at least 2 weeks." Client hears that and ends up on wordpress next redesign. Code quality ultimately doesn't matter to site owners so long as the site works.
- pibechorro 4y ago
  Except they dont. Leveraging 30 plugins makes the sites a constant hack target and perform piss poor in SEO page speed test, etc. That lets fix it with plugins attitude works for entry level sites, but if you actually are profitable and competitive its more trouble than hiring someone to build a lean site, even if using WordPress for content in the backend. Less is more.
  - dageshi 4y ago
    By the time you've reached 30 plugins of actual required functionality that effects page speed and existing caching solutions can't help you then yeah you probably need to build it custom, but there's a big old gulf of time before you reach that point where WP will serve just fine.
  - igetspam 4y ago
    What's the alternative? I am not a creative type and I've been desperately trying to find something like a CMS that is simple enough that I don't have to think about it and featured enough that I can have things like personal profiles behind a login (for a brownie troop). WordPress seems like the same nightmare it was when I first looked at it however long ago but so do all the rest. Is there something better?
cynicalsecurity 4y ago
That's a cheap, emotional and factually incorrect statement. Thank you, I'll happily keep working with WordPress.
- 9dev 4y ago
  No, it’s not. My statement is grounded in years of working professionally with CMS systems for customers at an agency, as an engineer helping out our marketing department, and maintainer of a popular niche CMS. If you’re happy with Wordpress, by all means, keep on going. My critique isn’t targeting you.
unity1001 4y ago
> If you haven’t seen the source, you don’t know just how god-awful the code is And yet, it runs 50% of all websites and 30% of all ecommerce websites. ... Apparently it is not god awful. If running 50% of the web is godawful, anybody would want their software to be that much 'godawful'... Empty elitism contrasting the actual reality of life and business...
- 9dev 4y ago
  Just because we don’t have a better choice doesn’t make Wordpress a good choice.
  - unity1001 4y ago
    If another choice was better, it would break out in the last 25 years of the Internet. All kinds of frameworks, cmses and actual SaaS services with 'better code quality', 'better security' and 'better programming paradigms' competed and attempted to take its place. If after 25 years, none of those 'better' ones was able to prove itself !actually! better to the end users in any visible way, then it means that WordPress WAS the better one. At this point you will definitely think "Oh, but the people dont know about good code quality". They don't. And they don't have to know. They know what reflects on their websites, businesses, actual livelihoods. Those who use WordPress are not disattached MBAs managing gigantic organizations. They are people whose lives actually hang on those websites and ecommerce sites. What the software does actually dictate their income, their livelihoods. For that reason they absolutely don't care about any esoteric programming paradigm or code quality which is !supposed! to impact their livelihoods greatly, but for some reason, it just doesn't. Definitely not to the degree that the proponents of criticism like yours think it does. Only WordPress came forward as the software that cares about those end users' websites, businesses, livelihoods, by prioritizing them instead of 'good quality code' or programming paradigms and protecting backwards compatibility as if the existence of the world depended on it. Whereas all the other competing software and even actual services including large tech giants on the other hand, literally played with people's livelihoods by introducing backwards incompatible versions in the name of 'better code and programming' - breaking the websites and shops that those people's lives depended on. And it turns out that you can break someone's website or ecommerce site by introducing backwards incompatible updates once, twice, and a third time you wont be able to do that because that person will have moved on to a software that doesn't play with his livelihood like it was a little hobby project. That's precisely why WordPress won. While in mid 2000s all the competitors were breaking their users' websites by pushing out backwards-incompatible versions, WordPress fought tooth and nail to protect backwards incompatibility. The result is trusting users and a gigantic ecosystem of plugins and themes that allows anyone to do literally anything they want. People became able to just click a button to install a plugin and make literally complex features happen. What was happening on the side of competitors during that period? Well, they were forcing people to write entire freaking modules just to add one measly form on their websites. Because, 'coding paradigms'. That's why the flower shop owner somewhere in Oregon runs his local flower business on his WordPress site and the notable anime blogger somewhere in Tokyo is on WordPress more than 15 years. WordPress treats their websites with care, knowing that those sites and shops are actually those people's homes on the Internet, and refrains from breaking anything or doing anything that could impact those people negatively in the name of 'better paradigms'. Speaking of better paradigms, is there any yet? Back in mid 2000s OOP was the end-all-be-all. Everything had to be OOP. All the cacophony even forced WordPress to introduce objects everwhere around its code. Because, 'better paradigms', right. And then a few years later suddenly functional programming is much better! Or, half of the programmers say so. Suddenly everyone is going in the other direction, whereas the die-hards of OOP still insist that it is 'the thing'. It was just a few years ago that hooks in React were going to change everything. Everybody! Move to hooks! Then it just turns out that hooks aren't so good after all. Literaly 2 year fad. Also everyone has to move to React or some other bloated framework, because, you know, you have to have a 'modern' frontend, right. Then suddenly people start saying that maybe not everything needs that much dom manipulation after all, and rendering everything on the server and serving the user something that his or her device can handle is much better. Who would have thought. But all of these cacophony forced even WordPress to adopt some React. Because, 'modern', you know... So this kind of programming fads even impacted WordPress, but WordPress still spent the effort to avoid any of those fads from breaking people's websites. And that's why its 50% of the web and 30% of all ecommerce today. Because it prioritizes its users and their livelihoods. As opposed to programming fads and elitism. ... Make no mistake - this paradigm does not only cripple the competitors of WordPress. It also cripples software industry in general, including tech giants. Living in our own world, thinking that the paradigms we have in programming are all important for everyone as opposed to just a fraction of our modern tech jobs, we prioritize the wrong things instead of prioritizing the actual users of the software and their livelihoods. Leading to literally crippling people's websites, apps and kicking their livelihood in the butt, losing them to whichever ecosystem that does not do such neglectful and out-of-touch things. An excellent example of this is shown by Google. It turns out even being a top tech giant does not allow one to avoid the repercussions of not prioritizing the users and instead playing with their livelihoods as if they were pet projects. https://steve-yegge.medium.com/dear-google-cloud-your-deprecation-policy-is-killing-you-ee7525dc05dc https://steve-yegge.medium.com/dear-google-cloud-your-deprec...
pxtail 4y ago
It's hard to understand for me why Wordpress core maintainers and developers decided to not uplift developers working in the WP ecosystem and in the result improve all plugins and themes codebase. Just simply providing a few well documented plugins with modern coding practices showing how things SHOULD be done would to wonders, adding to that good documentation introducing guidelines and standardization, good API for admin interfaces would gradually, over time change WP ecosystem. Instead it's just wild wild west, code review is a pain because every plugin and every developer working with WP has radically different structure and coding practices approach. In regard to WordPlate project - I can guarantee that huge amount of plugins and themes won't work correctly with this modified, non-default project structure.
JodieBenitez 4y ago
The code is awful, but some plugins are even worse. And the database schema... such a nightmare. I have the luxury to be able to refuse Wordpress projects. In fact whenever I can I replace Wordpress with Django.
- MonaroVXR 4y ago
  Django is also my go-to idea.

by 9dev 4y ago

mpol 4y ago

WordPress uses the PHP-mysqli extension. The PHP-mysql extension is unused since WordPress 3.9, quite some years ago. You might mean PHP-pdo is advised. Can you explain why it is better in this regard? Also $wpdb->prepare() uses parametrised values. Not everywhere in WordPress core is it being used. Most plugins use it for direct queries (not that common), but I don't know if the plugin team refuses plugins when they are not using it.

9dev 4y ago
Read this article for a primer on why PDO is a vastly better choice: https://phpdelusions.net/pdo#why https://phpdelusions.net/pdo#why And the fact that it’s 2023 and we’re somehow ok with the biggest web application there is not using parametrised queries in its core completely stumps me. Time and time again, SQL injection attacks in Wordpress or it’s plugins pop up. PDO with parametrised queries simply eliminates this issue.
- luckylion 4y ago
  > PDO with parametrised queries simply eliminates this issue. True, but plugin authors not caring about using them is the primary issue, and that doesn't change just because wpdb uses a different API under the hood.
  - 9dev 4y ago
    No, but nobody will encourage them to. Wordpress has fostered an ecosystem of bad practices that is mostly resistant to change.
tyingq 4y ago
>Also $wpdb->prepare() uses parametrised values. They appear to be a hand-rolled PHP version of imitation client-side parameterized values, not the actual database library ones. https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wpdb.php#L1494 https://github.com/WordPress/WordPress/blob/master/wp-includ...
- berkle4455 4y ago
  Wow. That is so much code just to avoid calling mysqli_prepare(). And they insist on using a weird printf inspired syntax instead of ? or :field.
  - tyingq 4y ago
    I suppose it's pretty battle-hardened by now, but I'd be afraid to ever touch that code for fear of introducing a SQL injection.

kijin 4y ago

There's much more to WordPress than the ecosystem. If we just think of it as a legacy tool that is only limping along because of the plugins, we will forever be perplexed that it continues to exist. WordPress is the FLOSS alternative to Wix et al. It is the only practical software that enables people to create and self-host an online presence without having to type a single line of code, and without being beholden to a large centralized platform. No, a static site generator that requires knowledge of Markdown and a few lines of bash doesn't count. A CMS that requires you to hire a professional to even get started doesn't count, either. It might seem strange to developers like us, but there are lots of people out there who are simply allergic to code. They can use PowerPoint and maybe even Photoshop, but show them a blank terminal and they'll just freeze. WordPress, on the other hand, can be navigated with a bunch of point-and-click, drag-and-drop, buy this and add that and change the options a bit. Just like PowerPoint, it barely works, but it works. Very few people in our startup bubble seem to care about these "I want a website, but no code please" people, and when we do we often treat them with contempt. How hard can it be to copy and execute a few commands, after all? But apparently that market is large enough to attract a sustainable ecosystem of plugin and theme sellers. WordPress has this market completely cornered. It won't magically disappear just because it's built in crappy code. Understand the users, on the other hand, build a good alternative, and that billion-dollar market might become yours. :)

DoctorOW 4y ago
> Understand the users, on the other hand, build a good alternative, and that billion-dollar market might become yours. Isn't that the entire point of Ghost?
- kijin 4y ago
  The installation guide for self-hosted Ghost assumes that you have at least a virtual private server, and gives you a bunch of commands to type into a root shell. By that time, you've already lost 90% of the people who would have chosen WordPress.
  - MonaroVXR 4y ago

sdze 4y ago

Why would you change a successful product just because the "language evolves"? PHP is so successful precisely because it lets all the legacy code live. To the contrary, with each PHP iteration, "bad code" is executed faster with fewer energy utilized.

9dev 4y ago
It’s not because the language evolves - which it does - but because Wordpress is built on bad patterns, abuse of legacy features, and simply heaps upon heaps of bad code. This leads to PHP itself having to make bad compromises for the future to keep the Wordpress code of millions of websites running; this leads to developers wasting time trying to accommodate Wordpress in plugins and themes; this leads to new developers growing up with bad standards and outdated practices. I’m not complaining Wordpress doesn’t follow the latest trends or won’t add arrow functions everywhere. I’m complaining they actively block the way to the future, like a senile senator with lots of unmerited influence and decade-old opinions.

dageshi 4y ago

There's no clear cut alternative CMS to use, that's the issue. If you own a wordpress site for your business and you want to change your dev or agency then you will have no problems finding people who understand WP and can work on/fix your site. It might cost you but you'll have no issues finding people to work on it. Use anything else and you'll be hunting down people who can and want to work on it. The other major issue is, the paid plugin ecosystem is vast in wordpress and because of that many problems can be solved with a plugin. The conversation typically goes "If this were on wordpress we'd buy this plugin for $xx and we'd be done in a few days, but it's not so we can build it for $xxxx and it'll take at least 2 weeks." Client hears that and ends up on wordpress next redesign. Code quality ultimately doesn't matter to site owners so long as the site works.

pibechorro 4y ago
Except they dont. Leveraging 30 plugins makes the sites a constant hack target and perform piss poor in SEO page speed test, etc. That lets fix it with plugins attitude works for entry level sites, but if you actually are profitable and competitive its more trouble than hiring someone to build a lean site, even if using WordPress for content in the backend. Less is more.
- dageshi 4y ago
  By the time you've reached 30 plugins of actual required functionality that effects page speed and existing caching solutions can't help you then yeah you probably need to build it custom, but there's a big old gulf of time before you reach that point where WP will serve just fine.
- igetspam 4y ago
  What's the alternative? I am not a creative type and I've been desperately trying to find something like a CMS that is simple enough that I don't have to think about it and featured enough that I can have things like personal profiles behind a login (for a brownie troop). WordPress seems like the same nightmare it was when I first looked at it however long ago but so do all the rest. Is there something better?

cynicalsecurity 4y ago

That's a cheap, emotional and factually incorrect statement. Thank you, I'll happily keep working with WordPress.

9dev 4y ago
No, it’s not. My statement is grounded in years of working professionally with CMS systems for customers at an agency, as an engineer helping out our marketing department, and maintainer of a popular niche CMS. If you’re happy with Wordpress, by all means, keep on going. My critique isn’t targeting you.

unity1001 4y ago

> If you haven’t seen the source, you don’t know just how god-awful the code is And yet, it runs 50% of all websites and 30% of all ecommerce websites. ... Apparently it is not god awful. If running 50% of the web is godawful, anybody would want their software to be that much 'godawful'... Empty elitism contrasting the actual reality of life and business...

9dev 4y ago
Just because we don’t have a better choice doesn’t make Wordpress a good choice.
- unity1001 4y ago
  If another choice was better, it would break out in the last 25 years of the Internet. All kinds of frameworks, cmses and actual SaaS services with 'better code quality', 'better security' and 'better programming paradigms' competed and attempted to take its place. If after 25 years, none of those 'better' ones was able to prove itself !actually! better to the end users in any visible way, then it means that WordPress WAS the better one. At this point you will definitely think "Oh, but the people dont know about good code quality". They don't. And they don't have to know. They know what reflects on their websites, businesses, actual livelihoods. Those who use WordPress are not disattached MBAs managing gigantic organizations. They are people whose lives actually hang on those websites and ecommerce sites. What the software does actually dictate their income, their livelihoods. For that reason they absolutely don't care about any esoteric programming paradigm or code quality which is !supposed! to impact their livelihoods greatly, but for some reason, it just doesn't. Definitely not to the degree that the proponents of criticism like yours think it does. Only WordPress came forward as the software that cares about those end users' websites, businesses, livelihoods, by prioritizing them instead of 'good quality code' or programming paradigms and protecting backwards compatibility as if the existence of the world depended on it. Whereas all the other competing software and even actual services including large tech giants on the other hand, literally played with people's livelihoods by introducing backwards incompatible versions in the name of 'better code and programming' - breaking the websites and shops that those people's lives depended on. And it turns out that you can break someone's website or ecommerce site by introducing backwards incompatible updates once, twice, and a third time you wont be able to do that because that person will have moved on to a software that doesn't play with his livelihood like it was a little hobby project. That's precisely why WordPress won. While in mid 2000s all the competitors were breaking their users' websites by pushing out backwards-incompatible versions, WordPress fought tooth and nail to protect backwards incompatibility. The result is trusting users and a gigantic ecosystem of plugins and themes that allows anyone to do literally anything they want. People became able to just click a button to install a plugin and make literally complex features happen. What was happening on the side of competitors during that period? Well, they were forcing people to write entire freaking modules just to add one measly form on their websites. Because, 'coding paradigms'. That's why the flower shop owner somewhere in Oregon runs his local flower business on his WordPress site and the notable anime blogger somewhere in Tokyo is on WordPress more than 15 years. WordPress treats their websites with care, knowing that those sites and shops are actually those people's homes on the Internet, and refrains from breaking anything or doing anything that could impact those people negatively in the name of 'better paradigms'. Speaking of better paradigms, is there any yet? Back in mid 2000s OOP was the end-all-be-all. Everything had to be OOP. All the cacophony even forced WordPress to introduce objects everwhere around its code. Because, 'better paradigms', right. And then a few years later suddenly functional programming is much better! Or, half of the programmers say so. Suddenly everyone is going in the other direction, whereas the die-hards of OOP still insist that it is 'the thing'. It was just a few years ago that hooks in React were going to change everything. Everybody! Move to hooks! Then it just turns out that hooks aren't so good after all. Literaly 2 year fad. Also everyone has to move to React or some other bloated framework, because, you know, you have to have a 'modern' frontend, right. Then suddenly people start saying that maybe not everything needs that much dom manipulation after all, and rendering everything on the server and serving the user something that his or her device can handle is much better. Who would have thought. But all of these cacophony forced even WordPress to adopt some React. Because, 'modern', you know... So this kind of programming fads even impacted WordPress, but WordPress still spent the effort to avoid any of those fads from breaking people's websites. And that's why its 50% of the web and 30% of all ecommerce today. Because it prioritizes its users and their livelihoods. As opposed to programming fads and elitism. ... Make no mistake - this paradigm does not only cripple the competitors of WordPress. It also cripples software industry in general, including tech giants. Living in our own world, thinking that the paradigms we have in programming are all important for everyone as opposed to just a fraction of our modern tech jobs, we prioritize the wrong things instead of prioritizing the actual users of the software and their livelihoods. Leading to literally crippling people's websites, apps and kicking their livelihood in the butt, losing them to whichever ecosystem that does not do such neglectful and out-of-touch things. An excellent example of this is shown by Google. It turns out even being a top tech giant does not allow one to avoid the repercussions of not prioritizing the users and instead playing with their livelihoods as if they were pet projects. https://steve-yegge.medium.com/dear-google-cloud-your-deprecation-policy-is-killing-you-ee7525dc05dc https://steve-yegge.medium.com/dear-google-cloud-your-deprec...

pxtail 4y ago

It's hard to understand for me why Wordpress core maintainers and developers decided to not uplift developers working in the WP ecosystem and in the result improve all plugins and themes codebase. Just simply providing a few well documented plugins with modern coding practices showing how things SHOULD be done would to wonders, adding to that good documentation introducing guidelines and standardization, good API for admin interfaces would gradually, over time change WP ecosystem. Instead it's just wild wild west, code review is a pain because every plugin and every developer working with WP has radically different structure and coding practices approach. In regard to WordPlate project - I can guarantee that huge amount of plugins and themes won't work correctly with this modified, non-default project structure.

JodieBenitez 4y ago

The code is awful, but some plugins are even worse. And the database schema... such a nightmare. I have the luxury to be able to refuse Wordpress projects. In fact whenever I can I replace Wordpress with Django.

MonaroVXR 4y ago
Django is also my go-to idea.