4

What is a plugin lifetime within a deployed instance of WordPress?

Namely:

  • do plugins modify existing files or do they only use defined extension points within WordPress?
  • are plugins allowed to modify database schema (e.g. add new columns)?
  • how does Wordpress make sure that plugin uninstall always leaves WP in original state? (Does it?)
15

Short answer:

  • Plugins do not modify existing files, they hook into WordPress via an exposed API.
  • Plugins can modify database schema.
  • Plugins don't have to uninstall cleanly.

Plugin Hooks

Plugins hook into WordPress at specific point exposed by the WordPress core.

http://codex.wordpress.org/Plugin_API

As an example, the function get_option() reads a site option from the database. Before any real action is taken inside this function, WordPress calls apply_filters( 'pre_option_' . $option, false ). Given an option foobar, a plugin could override this option's true value with the following code:

function override_foobar( $unused ) {
    return 'My custom value.';
}
add_filter( 'pre_option_foobar', 'override_foobar' ); // add_filter(hook, function)

See also http://adambrown.info/p/wp_hooks/.

Plugins modifying the database

Plugins have the ability to modify the database, assuming the WordPress database user still has that permission. Some of the more complex plugins add their own tables. It's possible that a plugin could modify core tables, and hopefully they would do this responsibly and in a way that doesn't break things if the plugin is removed.

This has to be examined on a plugin-by-plugin basis.

Uninstalling plugins

The deactivate_plugins() function calls the action do_action( 'deactivate_' . trim( $plugin ) ). A plugin should hook to this action if specific things need to happen when the plugin is deactivated. In my experience few plugins do a lot of deactivation cleanup, ie. putting their settings in cold storage in case they are activated again.

  • 1
    Good answer. A point on the first answer though; I'd say "They should not..." vs. "They do not..." – MikeSchinkel Aug 16 '10 at 18:43
3

Plugins in WordPress do what the code says. To answer specifically to your questions,

  1. They shouldn't, but there's nothing stopping them from modifying core files.
  2. They are allowed to fully interface with the database in any way that WordPress itself can.
  3. WordPress doesn't make sure that a plugin uninstall doesn't destroy the whole installation. If a plugin author set the uninstall function to delete everything, it would do it.

So this leaves the question, what can be done if a plugin author betrays your trust and does something malicious to your site? Having regular backups of your wp-content directory as well as your whole database is the best way to ensure you will be able to recover in the event that something happens to your site (e.g. data loss, hack attack, bad plugin, etc.).

  • It's a good point: plugins can do anything PHP can do, and overly-permissive file permissions leave you open to bad plugin behavior. – Annika Backstrom Aug 16 '10 at 14:48
1

Straight answer: NO

Plugins can do whatever you can do with PHP code..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.