4 ms·
The mere fact that anyone would have to check for SQL injections by anything other than using prepared statements at all is very descriptive of the WordPress ec
by 9dev 3y ago
The mere fact that anyone would have to check for SQL injections by anything other than using prepared statements at all is very descriptive of the WordPress ecosystem and the kind of engineering conventions it enables. It’s a sad state of affairs that this terrible insecure mess is the base of so many websites.
„Well it may be terrible but everyone uses WordPress, so I can’t be that bad, eh?“ - wrong. WP was in the right place at the right time, everything else is momentum.
Anyone without any qualification sells themes and plugins, and it shows. In the construction industry, there’s a lot of codes and safety regulations to prevent that and ensure proper practices; it’s a shame the software industry doesn’t.
- racked 3y agoWordpress actually provides a database wrapper (I wouldn't call it an ORM) called WPDB, which can use prepared statements. In practice though, I have found myself on more than one occasion just using PDO in my plugins. WPDB is slower, and its API is weird, like a lot of APIs in Wordpress land are.