If your websites use WordPress, put down that coffee and upgrade to 4.8.3. Thank us later

Re: It is 2017 and paid devs have not heard of bind variables

It is 2017 and paid devs have not heard of bind variables

It's 2017, and people are still using WordPress, which hasn't updated the APIs for its database library in over a decade, in the name of backward compatibility.

[Almost] everyone else in the PHP world has moved on and is using proper variable binding on their DB queries, but WP is stuck in the past.

WP does in fact pretend to do variable binding -- you pass an array of variables into a method called prepare(), just as you would expect. But internally, it then uses basic string replacement to embed those variables into the actual query. Go and look at Ferrara's blog post to see the full horror of the code for WPDB::prepare. If you're using WordPress, then you are using this code. Go and read it and understand it. Now take a step back and rethink your choice of CMS.

Re: It's better than Windows

You lucky, lucky, bastard!

Today I got an email saying "Hiya! Your site at http://squirrellovers.org has been updated automatically to WordPress 4.7.7."

To be fair, it also included a link to upgrade to 4.8.3, which took seconds

Re: PHP FFS

Of the three I hate PHP the most because it copied too much from Perl. VB is truly awful but it's also on the way out.

Justify using Wordpress? I guess people use it because it's easy, it's included with cheap hosting packages (or you can have Wordpress host it for you), and the huge variety of plugins make it flexible.

It's possible for almost anyone to set up a quick blog with more features than, say, Blogger. I don't know how it compares with the point and click setups (maybe Wix, judging purely by their ads - no personal experience to judge), but that's the justification. People don't care about the details - they want a pretty website easily and quickly.

I'm sympathetic to that, but less sympathetic towards businesses that rely on Wordpress, shoehorning shopping carts and other add-ons onto a platform that really isn't designed for that kind of content.

"Compare with Drupal, which has a similar lineage, but has had several major overhauls to its code-base, and today has a reasonably well-written core."

I would sooner shit out a hedgehog backwards than work with Drupal. It's awful. Always has been, continues to be so. Even the inclusion of Symfony components don't improve it. And I say this as a guy who, too, would take the hedgehog than use WordPress.

WordPress is the darling of the web agency world, just because it's so easy to set up and expand with 3rd party plugins. Plus you have the benefit of outsourcing WordPress builds to those in India while you stay in the UK and drum up more business. Business from those businesses who don't give a shiney shite about how the website works, they just want a website "To get to the top of Google".

But then what happens when WordPress needs updating? A vanishingly small amount of agencies will update them when needed, but how long do you do that for a website that paid £5,000 8 years ago and only pays you the minimum for hosting? More often than not (like I've said many times before) the agencies either don't bother, care, or charge the customer for the updates. If the customer says no, the site doesn't get updated. Putting their site at risk, which is a horrific thought when you consider what @Spudley mentioned, as these sites have shopping carts etc added.

It's horrific software that exists because it gets the job done for the most minimal of outlays both in terms of time and developer resources.

Re: Alternatives to WordPress?

OctoberCMS is a good alternative.

Re: Alternatives to WordPress?

If WordPress really still is considerably flawed from the ground up, what similar open source blogging platform or lightweight CMS would any of you recommend in preference instead?

Almost any of them will be a better choice than WP to be honest, but it depends what you're looking for.

If you're looking for a good ecosystem beyond the core CMS (ie plenty of plugins and support), try Joomla.

If you're looking for a platform with a reputation for scalability, look at Drupal.

If you're looking for a good newcomer that majors on clean code and ease of use, try OctoberCMS.

If you're looking for a free CMS but with commercial backing, try CraftCMS

If you're looking for a focus on security, try Concrete5.

But that's just the first few I could think of, and all in the PHP world. There's a mountain of other competing CMS platforms out there. Not many of them are trying to be WordPress because WP themselves have that market well and truly cornered, but they all have their strengths. It's worth trying out a few to see which works best for you.

Looking at Mr Ferrara's post it seems that WP still uses the mysql database driver, not PDO (or mysqli).

How long has it been deprecated ? Six years? That's inexcusable.

But I still don't see why fixing it properly should break plugins?

It can't be using the old mysql driver because WordPress supports PHP 7 which no longer includes it. However, it does use its own database wrapper. This wrapper has been upgraded so it doesn't use the mysql driver any more, but it still exposes the same original API that it always did, so it isn't using any modern DB techniques internally like prepared statements, even though it is internally using a DB driver that would support them.

Worse than that, the API was written to emulate prepared statements, and a number of recent WP flaws (including this one) have come about as a direct result of the poor quality implementation of this feature.

So it may not be using the mysql driver, but it may as well be, because it the API it presents dates back to the days of that driver and carries with it all the flaws and compromises that were made back when it was first written. And you're right, that is inexcusable.

The sad thing is that they really can't fix it, because fixing it would completely break the entire WordPress ecosystem.

It would indeed break all the plugins because the only way to fix it properly is to radically overhaul WP's DB library, including the API that it exposes, which is of course used by every WP plugin there is.