TRUTH.
It’s even scarier how poor a programmers the people who created it in the first place are – much less all the stuff hardcoded into the output when it ALLEGEDLY has a skinning system. (see all the blasted ‘classes for nothing’ on anchors and lists and raging chodo for pointless full URL’s)
The biggest problem I have with it is that if often seems that rather than make a function, they just make another file… as if another file request is somehow better than having a function already loaded and parsed.
I mean, go through the ‘logic flow’ of it… (this is from 2.9, I’ve not bothered downloading anything newer since I don’t use WP)
Index.php (397 bytes)
one define, a require… and ‘done’???
Takes us into wp-blog-header.php (274 bytes)
if the define we JUST made is set, set a global, do a require, run ONE function, and then do ANOTHER require AFTER calling the function?
So we look at the first require in that, and it’s wp-load.php (2.28k) where it sets ANOTHER define that is nothing more than a alias to a split of a superglobal, an if statement that by all indications should NEVER trip unless some other code is repeatedly calling this same file (in which case why isn’t this in a FUNCTION), and then FINALLY they it actually loads the config file… only took three separate files to get to this point.
What type of idiocy justifies THAT?!?
It’s also chock full of “No ****” comments.
/** Define ABSPATH as this files directory */
define( 'ABSPATH', dirname(__FILE__) . '/' );
No, really?
if ( file_exists( ABSPATH . 'wp-config.php') ) {
/** The config file resides in ABSPATH */
require_once( ABSPATH . 'wp-config.php' );
Huh, is that why you’re requiring it from there?!? DOOEEY?!?
… and again, not a single function to be found in that file…
From there you have the total idiocy that is wp-config.php
BECAUSE PUTTING THE MYSQL USERNAME AND PASSWORD INTO DEFINES WHICH ENDS UP JUST LIKE SUPERGLOBALS MAKES THE SYSTEM SO SECURE!!!
That’s like driving a Caddy Escalade into South Central and leaving the doors wide open with the keys in the ignition.
It’s no wonder it won the 2008 Pwnie for M4ss 0wnage – things that are security BASICS they do the exact opposite at every step!
Secure information stored in defines?!? Sub-libraries that you can call directly and have it actually create output with most everything run outside of functions? So many entrance and re-entry points that it’s almost impossible to secure?!?
Much less when you get into the next file, wp-settings where it unregisters globals but then goes and screws around with storing a bunch of pointless nonsense in $_SERVER…
THEN of course you have this train wreck that is loaded EVERY time:
require (ABSPATH . WPINC . '/formatting.php');
require (ABSPATH . WPINC . '/capabilities.php');
require (ABSPATH . WPINC . '/query.php');
require (ABSPATH . WPINC . '/theme.php');
require (ABSPATH . WPINC . '/user.php');
require (ABSPATH . WPINC . '/meta.php');
require (ABSPATH . WPINC . '/general-template.php');
require (ABSPATH . WPINC . '/link-template.php');
require (ABSPATH . WPINC . '/author-template.php');
require (ABSPATH . WPINC . '/post.php');
require (ABSPATH . WPINC . '/post-template.php');
require (ABSPATH . WPINC . '/category.php');
require (ABSPATH . WPINC . '/category-template.php');
require (ABSPATH . WPINC . '/comment.php');
require (ABSPATH . WPINC . '/comment-template.php');
require (ABSPATH . WPINC . '/rewrite.php');
require (ABSPATH . WPINC . '/feed.php');
require (ABSPATH . WPINC . '/bookmark.php');
require (ABSPATH . WPINC . '/bookmark-template.php');
require (ABSPATH . WPINC . '/kses.php');
require (ABSPATH . WPINC . '/cron.php');
require (ABSPATH . WPINC . '/version.php');
require (ABSPATH . WPINC . '/deprecated.php');
require (ABSPATH . WPINC . '/script-loader.php');
require (ABSPATH . WPINC . '/taxonomy.php');
require (ABSPATH . WPINC . '/update.php');
require (ABSPATH . WPINC . '/canonical.php');
require (ABSPATH . WPINC . '/shortcodes.php');
require (ABSPATH . WPINC . '/media.php');
require (ABSPATH . WPINC . '/http.php');
require (ABSPATH . WPINC . '/widgets.php');
Much of which isn’t even used on most executions…
It’s spaghetti coding at it’s worst.