Checking a plugin for exploits -- How difficult?

PHP
1

Hi,

I recently had a situation with a Pakistani programmer go sour. It went like this

  1. Project starts and everything is on track
  2. Programmer disappears for about a week with no communication
  3. He comes back apologizing and saying there was a family medical emergency [if you’ve never outsourced before, this is a very common excuse]
  4. I tell the worker that late fees will be assessed according to our contract. The worker gets extremely upset, swears at me and basically shows signs of quitting the project.
  5. A few days later he changes his mind, probably because of how far along his work was. But he tries to insist on no late fees. I tell him that’s not an option especially after his behavior, which angers him again, but he says he will finish it.

So I am faced with the following dilemma–the wordpress plugin works well on his server, but this guy is somewhat hostile at this point, and probably knows that I have no recourse should he do something vindictive.

I have a few options

  1. Pay for the work and use it without checking it for exploits
  2. Pay for the work and don’t use it
  3. Don’t pay and cancel the project, which would be very unfair to him
  4. Pay another programmer to do a thorough check of the plugin.

My question: how realistic is it to have another programmer do #4 at low cost? I know little about PHP so I can see it being very tough or very simple, I really have no idea.

EDIT: The plugin is for a simple interactive PHP form that asks customers a series of questions and directs them to the appropriate page. It is basically the online equivalent of an automated phone directory. This is a Wordpress plugin.

Thanks for your advice

2

The plugin once installed has complete access to your database. If (although I dont think he would stoop this low) he has malicious intenet, he can build a script to email him some details of your database like say your passwords or user details.

If you dont trust him then go with option 4. The money you are saving from the late payment, use it for someone to inspect your code. Shouldn’t cost a lot for someone to just give it a quick once over.