Home » Questions » Why does WordPress still use addslashes(), register_globals() and magic_quotes?

Why does WordPress still use addslashes(), register_globals() and magic_quotes?

Answered
1
2

In order to gain more experience in Wordpress I delved into its code base to study its inner working and its workflow, and I was quite astonished when I saw that:

  1. They implement register_globals (an excerpt from wp-includes/class-wp.php):

     // The query_vars property will be extracted to the GLOBALS. So care should
     // be taken when naming global variables that might interfere with the
     // WordPress environment.
     function register_globals() {
        global $wp_query;
        // Extract updated query vars back into global namespace.
        foreach ( (array) $wp_query->query_vars as $key => $value) {
            $GLOBALS[$key] = $value;
        }
    
  2. They rely on magic quotes (exerpt from wp-includes/functions.php. magic_quotes_gpc is turned off at bootstrapping, before calling this function):

    function add_magic_quotes( $array ) {
        foreach ( (array) $array as $k => $v ) {
        if ( is_array( $v ) ) {
            $array[$k] = add_magic_quotes( $v );
        } else {
                $array[$k] = addslashes( $v );
        }
    
  3. They rely on addslashes (but since 2.8.0 they introduced also mysql_real_escape_string, but the _weak_escape() function that uses addslashes() still exists in the wpdb class)
    UPDATE: I see they emulate prepared statements by using sprintf() and custom placedholders, so queries should be safe I think. Still I’m puzzled on why they don’t provide at least mysqli, after all the detection of Mysql and PHP version happens early in the bootstrapping sequence.

Now, from the year-long frequentation of SO I learned a lot of things, especially that the above three function are “deprecated” and show security issues, and are watched in horror by many.

But WP must have a reason to use them. I’d like to know from more experienced programmers if there are really security issues, or if sometimes their usage is just too clouded in rumors and false convinctions. I know that magic_quotes is an heritage from the past, and the same could be said for addslashes (at least when used for databases), but while googling before asking this I found many websites talking about using addslashes() over mysql_real_escape_string().

I’m interested in knowing a clear, detailed reason on why those badly depicted functions are used; Wordpress had had many improvements over the years, addressing different aspects, and yet these functions are still used; I’m looking, therefore, to a concrete explanation over the positive aspects that somehow override the negative ones and justify the usage of those functions.

I’m not looking for opinions (I perfectly know they’re offtopic here), nor I am ranting about Wordpress, I hope this is clear. I’d just like to know why many php programmers consider these functions “bad”, and yet a worldwide giant like Wordpress, who’s at the 3rd version now, still uses them.

Is this for compatibility with different servers and php versions? (they check very earl for those, though).
Is there something I miss about this functions, how important they can be in an environment like wordpress (or in general)? I’m quite confused, to be honest.

NOTE: This question was originally posted at StackOverflow.com by Damien Pirsy

  • Carolyn
    I think all of those are terribly bad practice and believe that they are result of laziness or worse. :)

    NOTE: This comment was originally posted at StackOverflow.com by Vyktor

  • Jerry
    qdb.us/307623 ....

    NOTE: This comment was originally posted at StackOverflow.com by Wrikken

  • Dean
    What is sad is that "programmers" that code in "wordpress framework", are making more money than real programmers... No, you should not use it because of a reason.

    NOTE: This comment was originally posted at StackOverflow.com by webarto

  • Jimmy
    Stop asking and fix it, haha! That's why open source needs you, so you can find this problems, and fix them.

    NOTE: This comment was originally posted at StackOverflow.com by nycynik

  • Douglas
    Small quibble - WordPress is not at its "3rd version", as it does not use typical MAJ.MIN.PNT release methodology. It just increments by .1 at each release, with point releases for security and non-functionality changing bug fixes. I think I remember reading that the core team tries to do two releases each year. So the change from v2.8 -> v2.9 was the same "magnitude" of change as from v2.9 -> v3.0

    NOTE: This comment was originally posted at StackOverflow.com by kenny

Good Answer
1
0

Wordpress Open Tickets over Time
(Wordpress Open Tickets over Time)

Don’t rely on the Wordpress codebase to do assumptions about good practice or current standards in PHP coding. I’m saying this as someone who has fiddled with wordpress development over a longer period of time.

Wordpress codebase is about 10 years old, it’s full of legacy code[1]. The program can not evolve on the code-level much because of that, so you find a lot of workarounds for problems that are already solved nowadays much better.

Just take this story: PHP had magic quotes. Wordpress developers thought it was useful. So for those hosts that did not have it configured, they added it. Ending up whith code that expects slashed input data often and at various places. The simple thing is, now they just can’t change it to proper input processing and sanitization easily because of the usage of (super)globals introducing static global state nearly everywhere.

You can not easily refactor such code.

Same for the database class. It has a long history, originally based on an early version of ezSQL. At that time there was not mysql_real_escape_string and when it was introduced, the WP devs had the problem that not all installation bases support it.

So don’t wonder about the coding practice you find inside the Wordpress code. You’ll learn how things could have been done years ago and with more or less outdated PHP versions. It’s not that long ago that Wordpress switched to PHP 5 for example.

  • Backwards compatibility.
  • Target a large amount of (technically more or less outdated) hosts.
  • Don’t break what works with defects.

This might not be your list of priorities (hopefully), projects differ here a lot. But having a legacy code-base alone is a burden regardless how project priorities are set. Wordpress is only one example.


[1] see Milestones of WordPress: Early Project Timeline (ca. 2000 to 2005))

NOTE: This answer was originally posted at StackOverflow.com by hakre

  • Robin
    Over 361 million people view more than 2.5 billion pages each month on WP sites and there are over 71,000,000 sites worldwide using it. So 1,300 bugs in relation to usage is very, very low percentage wise, so low in fact my calculator started getting scientific on me!

    NOTE: This comment was originally posted at StackOverflow.com by gus

  • Wayne
    @gus if those 361 million people were all programmers, bug count would be astronomical; the success of WP is, in fact, that you just need to be able to read and write in order to use it; don't rely on the people using it to assume the code is optimal; after all, how many PCs are powered by Windows?

    NOTE: This comment was originally posted at StackOverflow.com by Damien Pirsy

  • Robin
    @hakre I agree, of course its better to build on solid foundations. But things change over time like the PHP versions, OS, expectations and functionality and people don't have crystal balls. What we "think" is good practice today may also be considered total rubbish in 5 years time and full of legacy code.

    NOTE: This comment was originally posted at StackOverflow.com by gus

  • Robin
    @hakre as i said before you didn't mention that the graph is not official nor is it verified and may not be accurate. You have also made an assumption that keeping the number of open tickets low is not an objective. According to who exactly? Have you verified that with WP?

    NOTE: This comment was originally posted at StackOverflow.com by gus

  • Robin
    what i find really funny is your profile points to hakre.wordpress.com LOL

    NOTE: This comment was originally posted at StackOverflow.com by gus

1
0

There is no better way to answer why they are bad than referring to the PHP documentation on magic_quotes:

Also note:

This feature has been DEPRECATED as of PHP 5.3.0. Relying on this feature is highly discouraged.


So why does Wordpress still use Magic Quotes?

Wordpress minimum requirements uses PHP 4.3. Yes, it is absolutely a backwards compatibility reason.

What about the other functions?

I am honestly not sure. Relying on super globals is a very bad idea. This is simply laziness of the Wordpress development team. Perhaps they have more important issues to work on.

NOTE: This answer was originally posted at StackOverflow.com by Levi Morrison

  • Diana
    what's the point in using magic quotes for compatibility reason?

    NOTE: This comment was originally posted at StackOverflow.com by Your Common Sense

  • Joan
    @Col.Shrapnel Because they are on by default in older versions. I admit, they should have undone the magic quotes instead of enforcing them, but it was probably a decision made when PHP 4.3 was the major version and some people had it turned off. Makes sense.

    NOTE: This comment was originally posted at StackOverflow.com by Levi Morrison

  • Laurie
    Wordpress (capital_p_dangit:) updated the PHP requirement to 5.2.4 since WP 3.2. They will probably remove these old things once.

    NOTE: This comment was originally posted at StackOverflow.com by biziclop

  • demo
    caramba
  • You must to post comments
0
0

They did this for one reason:

To make sure Wordpress is compatible with most Web Hosting providers.

NOTE: This answer was originally posted at StackOverflow.com by I'll-Be-Back

  • Wayne
    That's what I thought, but since they check very early for php and mysql version, that means they could serve different code for different situations (pre php5 - post php 5) and that wouldn't increase their codebase so dramatically.

    NOTE: This comment was originally posted at StackOverflow.com by Damien Pirsy

  • You must to post comments
0
0

This is wrong place to ask such a question.
It is always a bad idea to ask some third party person of the reasons someone else had somewhere else.

It is obvious that you can’t get an answer here unless you will lure some authorized wordpress developer here with such a bounty.

Yet your question is too broad. However, it is possible to answer it’s abstract part:

I’d like to know from more experienced programmers if there are really security issues, or if sometimes their usage is just too clouded in rumors and false convinctions.

Does hands washing really prevents a disease?
What if I won’t wash my hands – will I surely sick?

Most of time – no.
As a general habit – yes.

These features (although indeed, as any other feature of our unlucky language, too clouded in rumors) are merely a hygiene everyone have to follow as a basic instinct.

Although most of time…

  • addslashes won’t do any harm as long as your encoding is either utf-8 or any single-byte one;
  • register globals won’t do any harm if you initialize all your variables;
  • magic quotes won’t do any harm as long as you have all your variables quoted for the SQL and slashes stripped for any other use;

…any exception from these circumstances can make you sick with high probability.

NOTE: This answer was originally posted at StackOverflow.com by Your Common Sense

  • Wayne
    Well, if any wordpress developer is lured in I'd be grateful: an "official" response would beat any "third party person"'s idea and opinion, so I don't see the bad aspect in this. And thanks (+1) for your last addition, showing that no harm can (generally, if used properly) come from these functions is a big step in better understanding how they work and how they can be used.

    NOTE: This comment was originally posted at StackOverflow.com by Damien Pirsy

  • You must to post comments
8
0

In complement to @tom answer.

Magic Quotes

Automatically parsing the whole entries and adding magic quotes is both creating bugs and useless.

  • Useless as you cannot rely on magic quotes to secure your input (multy-bytes encoding bugs for SQL injections is an example). So you need to apply a real filter before saving your data to a database
  • Creating bugs: If you need to really escape your data before a save in database you have to check that it’s not already escaped (and the simple fact this settings exists and may be enforced by the hosting environment makes that you have to check this setting was set or not).
  • Creating bugs: All the data sent by the user is not always dedicated to a database storage. Escaping it may break the content, think about a json content for example, or even file content with the dangerous magic_quote_runtime
  • Creating bugs: All database storage are not escaping quotes the same way…

So Why?, why do we see such function in a CMS?

  • see that here it’s an add_magic_quotes function, that can be used on a dedicated array, maybe not on _GET or _POST. But effectively the fact this function is just using addslashes and not a database dedicated function makes it quite bad.
  • The fact the hosting provider may enforce an automatic magic quotes is a nightmare for a CMS developper. Either you detect it and tell the user you refuse to run, or you have to manage the fact the content may or may have not be magically-addslahed… and to put everyone in the same state, you run the non-addslashed content in this function so that at least everyone is in the same (bad) state.
  • From what I can see on Wordpress, before the save a stripslahes_deep is performed in the wp_insert_post. And add_magic_quotes is usually performed on data pulled from Db before this data is send to the wp_insert_post. This may me think the problem is effectively to add slashes before removing them… maybe because sanitize filters which append before the save expect content with slashes, or maybe because no one remember why the code is running in this way 🙂

register_globals

Seems that this is the way to implement a Registry pattern in wordpress… They wanted to make the code simple to understand, and to allow a simple way to access importants objects like the query or the post. And an object oriented Registry class was not in the simple PHP way, where the $_GLOBALS array is already an existing registry.

Having a Registry is a perfectly valid thing in an application. a register_global thing is dangerous only if you allow some user input to override your valid secure input. And of course only if this secure input is taken from $_GLOBALS elsewhere (or with global keyword).

The dangerous part in the function here is the part of the function you have extracted, the loop on $query->query_vars. You will have to track the calls to see if user injected keys could run throught wp_parse_args and finish in that function. But the next part of this function is fixing $_GLOBALS content for several objects:

$GLOBALS['query_string'] = $this->query_string;
$GLOBALS['posts'] = & $wp_query->posts;
$GLOBALS['post'] = (isset($wp_query->post)) ? $wp_query->post : null;
$GLOBALS['request'] = $wp_query->request;

So at least theses globals cannot be overwritten by user input and are safe.

So, theses functions are bad. But you can use them if you understand what they do and what you need to do to prevent the bad effects. And when you want to implements a simple framework for developpers, available on a very wide environment you sometimes have to use them.

But for sure it’s a bad practice, you can certainly find bad wordpress plugins using *$_GLOBALS* in the wrong way or misusing the add_magic_quotes to data pulled from db wordpress concept. But there will be years before a Zend Framework CMS gained such a big number of contributions.

NOTE: This answer was originally posted at StackOverflow.com by regilero

  • You must to post comments
1
0

One of the main differences between mysql_real_escape_string() and addslashes is that mysql_real_escape_string() works in conjunction with the character set so it knows how to properly escape data based on the character set.

Generally I think the best approach is to use a request class and do all your stuff there.
That way there is only one place where you deal with GET,POST,COOKIE, SERVER etc which makes it far easier to manage in contrast to having a bunch of random functions doing different things. That’s just a recipe for disaster.

NOTE: This answer was originally posted at StackOverflow.com by gus

  • Robin
    its on sitepoint from memory, whats with the down vote. im not saying i agree.

    NOTE: This comment was originally posted at StackOverflow.com by gus

  • Diana
    nevermind, I guess I've found it myself. it seems you confused magic quotes with register globals and for some reason call it "fairly recent" instead of "a whole decade old" one.

    NOTE: This comment was originally posted at StackOverflow.com by Your Common Sense

  • Robin
    oh yeah so i did well spotted Col.

    NOTE: This comment was originally posted at StackOverflow.com by gus

  • Wayne
    Sorry, I don't understand how this relates to my question...I'm not asking which is the best approach, nor the differences between addslashes and m_r_e_s. I'd just like to know the reason behind wordpress code, if possible of course

    NOTE: This comment was originally posted at StackOverflow.com by Damien Pirsy

  • Robin
    Damien, your question requires some guesswork unless your one of the developers of wordpress. I think the others have covered the most likely scenarios as to why but its all speculation. Despite the responses some interesting facts are en.wordpress.com/stats

    NOTE: This comment was originally posted at StackOverflow.com by gus

1
1

Magic Quotes

The following text is taken from PHP.net

http://www.php.net/manual/en/security.magicquotes.why.php

There is no reason to use magic quotes because they are no longer a supported part of PHP. However, they did exist and did help a few beginners blissfully and unknowingly write better (more secure) code. But, when dealing with code that relies upon this behavior it’s better to update the code instead of turning magic quotes on. So why did this feature exist? Simple, to help prevent SQL Injection. Today developers are better aware of security and end up using database specific escaping mechanisms and/or prepared statements instead of relying upon features like magical quotes.

addslashes() vs mysql_real_escape_string()

The reason why you should use mysql_real_escape_string() is because it’s a “MySQL function” and is created especially for escaping user input before it’s executed in a mysql query, while addslashes() is a “PHP function”. That probably sounded a little weird, but there’s one important difference between the two and it has to do with the use of single- and multi-byte characters. You can still inject databases protected by the addslashes function, but injecting databases protected by mysql_real_escape_string is far more difficult. You can read more about it HERE

Register Globals

The reason why you should NOT use register_globals is because variables become accessible to everyone, which means that in the following example you would be able to set $access to true if it hasn’t been initialized before

<?php

if (isAuthenticated()) { $access = true; }

if ($access == true) {
  include(controlpanel.php);
}

?>

The above code would give you sh#! loads of problems, but if we initialize the variable first by adding the following to the top of the page

$access = false;

…we should be fine even if we have register_globals ON

So, if the Wordpress team have initialized all variables (which they probably have) then you don’t have to worry about the use of globals.

Conclusion

It’s definitely bad practice using any of those 3 functions/features and I would never do it myself. Are you sure you’re working with the latest version of Wordpress? Like someone commented, if you are using the latest version it’s because of laziness or worse it’s still in there. I’ld never use Wordpress for anything other than blogs that doesn’t require much security..

NOTE: This answer was originally posted at StackOverflow.com by Tom

  • Wayne
    Thanks for the infos, although I do know what those functions are, and that's the reason I asked why they're being used! Yes, it's the latest WP version (3.3.1).As for the mysql-only problem that's not an excuse for them, they could have implemented different drivers or at least provide a mysqli set of functions for news mysql, but not trace of them...Still puzzled

    NOTE: This comment was originally posted at StackOverflow.com by Damien Pirsy

  • Ann
    • Ann
    • 12 years ago
    • 3
    @DamienPirsy - Yeah, no clue why those functions are still in there. I wouldn't use Wordpress for anything other than blogs that doesn't require much security..

    NOTE: This comment was originally posted at StackOverflow.com by Tom

  • Jim
    • Jim
    • 12 years ago
    @Damien Pirsy: Last time I offered a patch mysql -> mysqli there was no interest (it's rather trivial). You can replace the db class with your own one if you like. But I think this has to do with wordpress.com and they don't want to change certain parts of the code. As long as it runs for the majority of users (most of them don't have any technical or programming interest), there just is no need to touch things. If you provide patches you have to wait ~ half a year - three years until you see a commit.

    NOTE: This comment was originally posted at StackOverflow.com by hakre

  • You must to post comments
1
1

Wordpress. I’ve spent a lot of sleepless nights trying to answer the only one question: “Why??”

Since I’ve faced with its source code I hate it. It is awful. And let my post(and reputation as well) will be minused but it’s true.

It doesn’t have core. There is a rubbish of code instead of core. It reminds php3. Huge heap of unrelated and unlogical functions are used in it. “Copy and Paste” – the only one design pattern is used in wordpress.

Yes, the have emulated using of prepared statements. But why they don’t use PDO, or mysqli? They have copypasted almost all PDO functions but haven’t use it instead. Using of mysqli instead of mysql requires even less efforts.

They use myql_real_escape_string. But there is still something like protect_string_strongly, protect_string_weakly. There is no only only one function – do_not_protect_string_i_believe_my_users.

Global variables – is the philosophy of wordpress. “If we don’t know how to change this var we’ll mark it as global var and everybody will be happy.” – here is what wordpress developers thought when they developed hellpress.

Every new version contains a lot of new in design, they add new default themes, they change background color in admin area from #ccc to #cdcdcd, they use dropdown menu in admin area instead of accordeon. And it awesome. But they do not improve its code.

Did you read comments in WP “core”? No? And I did. They are “awesome”. Something like “What this function is called for? Let’s it leave just in case.” or “Do not hardcode this in new version.” and so on.

The only one answer to the question “Why?” I got is: “Because it works. And if it does work do not touch it!!!”

wordpress.org is one most visited sites in the world. Why? Because nobody able to understand wordpress’s logic. Everybody every time needs to ask something on the forum or read in the codex.

I hope you understand my point of view.

NOTE: This answer was originally posted at StackOverflow.com by Ruslan Polutsygan

  • You must to post comments
0
0

ett

  • You must to post comments
Showing 9 results
Your Answer
Guest Author
Post as a guest by filling out the fields below or if you already have an account.
Name*
E-mail*
Website
CAPTCHA*
Enter the characters shown on the image.