To construct dynamic sql queries to have to string concatenate at least some parts, .
replyUser data should of course be passed via prepared statements.
One usually uses "query builder" pattern for that.
replyAlso, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.
ORMs and query builders ARE concatenating strings.
replyNot user code, no. Someone eventually has to, but virtually every ORM under the sun allows you to construct dynamic queries without having to concatenate strings yourself or resort to string interpolation.
replyQuick search shows this in Wordpress:
reply> WordPress database access abstraction class.
class wpdb {}
$results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}options WHERE option_id = 1", OBJECT );
It does not however prevent $wpdb users from NOT binding query parameters, which leads to this vulnerability.
It seems that wpdb doesn't support placeholders for comma-separated lists, like in "WHERE id IN (?)". So the developers have to fall back to string concatenation.
replyWordPress source code is a mess. They should re-write it from scratch using modern technologies, or even a framework like Laravel.
replyThat could as well just be a complete new product then, right?
replyIt would definitely be a breaking change and unmigratable.
A few months back, Cloudflare used AI to make a Rust rewrite of WordPress, but I doubt that they would have found or corrected issues like this on the way?
https://blog.cloudflare.com/emdash-wordpress/
replyTypeScript, not Rust.
replyMullenweg will never allow WP to slip away from his control. "He wrote it" so you can't have it.
replydeleted
replyWho is they? automaticc?
replyImpossible. WordPress has had the PHP-group even considering writing new PHP features in a separate 7.4 branche and release them specifically for WP.
reply