Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

What is a plugin lifetime within a deployed instance of WordPress?

Namely:

  • do the plugins modify existing files or do they only use defined extension points within WordPress?
  • are plugins allowed to modify database schema (e.g. add new columns)?
  • how does Wordpress make sure that plugin uninstall always leaves WordPress in original state? (Does it?)
share|improve this question

4 Answers 4

up vote 15 down vote accepted

Short answer:

  • Plugins do not modify existing files, they hook into WordPress via an exposed API.
  • Plugins can modify database schema.
  • Plugins don't have to uninstall cleanly.

Plugin Hooks

Plugins hook into WordPress at specific point exposed by the WordPress core.

http://codex.wordpress.org/Plugin_API

As an example, the function get_option() reads a site option from the database. Before any real action is taken inside this function, WordPress calls apply_filters( 'pre_option_' . $option, false ). Given an option foobar, a plugin could override this option's true value with the following code:

function override_foobar( $unused ) {
    return 'My custom value.';
}
add_filter( 'pre_option_foobar', 'override_foobar' ); // add_filter(hook, function)

See also http://adambrown.info/p/wp_hooks/.

Plugins modifying the database

Plugins have the ability to modify the database, assuming the WordPress database user still has that permission. Some of the more complex plugins add their own tables. It's possible that a plugin could modify core tables, and hopefully they would do this responsibly and in a way that doesn't break things if the plugin is removed.

This has to be examined on a plugin-by-plugin basis.

Uninstalling plugins

The deactivate_plugins() function calls the action do_action( 'deactivate_' . trim( $plugin ) ). A plugin should hook to this action if specific things need to happen when the plugin is deactivated. In my experience few plugins do a lot of deactivation cleanup, ie. putting their settings in cold storage in case they are activated again.

share|improve this answer
1  
Good answer. A point on the first answer though; I'd say "They should not..." vs. "They do not..." –  MikeSchinkel Aug 16 '10 at 18:43

It depends entirely on the plugin.

  • Do the plugins modify existing files or do they only use defined extension points within wordpress?

It is possible, although unlikely (and also a really bad things to - so if a plugin does this, I would ditch it). I have seen cache plugins that make changes to the wp config file.

  • are plugins allowed to modify database schema (e.g. add new columns)?

Allowed by whom? WordPress? Then yes. But similar to the above, they generally do not. The most drastic typically is adding its own table.

  • how does Wordpress make sure that plugin uninstall always leaves Wordpress in original state? (Does it?)

It doesn't. How a plugin leaves things is entirely up to the plugin developer. A good plugin cleans up after itself; a bad one does not. As a plugin developer myself, I always make sure that if the plugin is deleted via the plugin admin panel, that it removes any settings that it has stored in the options table. This isn't a requirement for a plugin, it's just good practice for the developer.

The bottom line is that you can't rely on plugin developers to always follow best practices, but you can rely on yourself. The best thing you can do is to never install an unknown/untested (by you) plugin on your production site. Always do testing in a staging environment until you are comfortable with what a plugin does (or doesn't do). And keep a clean backup you can roll back to before doing any changes. Following best practices is the best way to avoid a problem - just because some plugin developers don't follow best practices (such as cleaning up their mess) doesn't mean you shouldn't either.

share|improve this answer

Straight answer: NO

Plugins can do whatever you can do with PHP code..

share|improve this answer

Plugins in WordPress do what the code says. To answer specifically to your questions,

  1. They shouldn't, but there's nothing stopping them from modifying core files.
  2. They are allowed to fully interface with the database in any way that WordPress itself can.
  3. WordPress doesn't make sure that a plugin uninstall doesn't destroy the whole installation. If a plugin author set the uninstall function to delete everything, it would do it.

So this leaves the question, what can be done if a plugin author betrays your trust and does something malicious to your site? Having regular backups of your wp-content directory as well as your whole database is the best way to ensure you will be able to recover in the event that something happens to your site (e.g. data loss, hack attack, bad plugin, etc.).

share|improve this answer
    
It's a good point: plugins can do anything PHP can do, and overly-permissive file permissions leave you open to bad plugin behavior. –  Annika Backstrom Aug 16 '10 at 14:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.