[Update] Documentation for sniff WordPress.PHP.DiscouragedPHPFunctions by jasonkenison · Pull Request #2584 · WordPress/WordPress-Coding-Standards

jasonkenison · 2025-08-26T18:15:42Z

Related to #1722

Continuing requested edits from #2494

Updated indentation, added tags and a line break at the end of the file.

Closes #2494

jasonkenison · 2025-08-26T21:18:33Z

Added more details with code obfuscation examples in the final standard.

rodrigoprimo

Thanks for creating this PR, @jasonkenison!

I left some comments with suggestions. Let me know if you have questions.

rodrigoprimo · 2025-08-26T22:21:50Z

+        </code>
+        <code title="Invalid: Changing configuration at runtime">
+        <![CDATA[
+error_reporting( 0 );


This block and most of the blocks below are missing  tags.

In some cases the  tag is used to highlight just the function name and in other cases it is used to highlight the whole function call. Is there a reason for that? If not, I suggest highlighting just the function name in all examples.

rodrigoprimo · 2025-09-04T17:17:42Z

+        </code>
+        <code title="Invalid: Changing configuration at runtime">
+        <![CDATA[
+error_reporting( 0 );


I'm unsure (here and in other <code_comparison> blocks) if it is necessary to include an example for every single function that triggers the sniff. Please check other sniff XML docs if you can, but I believe it is more common to just include one example (if all the others are the same except for the function name). Then, if the list is not too long, you can consider mentioning all the functions in the corresponding <standard> description. What do you think?

I can see you addressed this point for most <standard> blocks except for the one related to functions used to obfuscate code. Is there a reason for that? Would it make sense to list the functions that trigger this warning in the <standard> description as you did for the <standard> blocks?

rodrigoprimo · 2025-09-04T17:19:54Z

+        <code title="Invalid: Using serialized data strings.">
+        <![CDATA[
+$serialized = <em>serialize</em>( $array );
+$unserialized = <em>unserialize</em>( $array );


Maybe it is better to use a variable name other than $array here as this function takes an string as its first parameter? The same applies to the json_decode() example above.

Please check if other variables could be renamed as well for the same reason in the other examples.

Apologies if my previous message was not clear. I can see you changed the variable name from $array to $my_array for all the function calls in this <code_comparison> block, but that is not exactly what I meant.

I think it is fine to use $array (or $my_array) for the functions that accept an array as the first parameter (wp_json_encode() and serialize()). But I don't think we should use $array (or $my_array) for functions that don't accept an array as the first parameter (json_decode() and unserialize()). $string (or something similar) would be fine in those two cases from my perspective. Do you agree?

rodrigoprimo · 2025-10-24T14:06:22Z

@jasonkenison, I was just wondering if you'll have a chance to finish this off in the near future. It would be great if this PR could be included in the next WPCS release.

If you haven't got time or lost interest, please let us know and we'll see if we can find someone to take over. Thanks!

rodrigoprimo · 2025-10-27T15:46:06Z

+        <code title="Invalid: Using functions to obfuscate code.">
+        <![CDATA[
+<em>eval( </em>base64_decode( $code_str )<em> )</em>;
+<em>convert_uudecode( $uuencoded )</code>em>;


Besides the point that I raised above about the placement of the  tags, I believe a typo was introduced in this particular line in the recent commits: code>.

rodrigoprimo · 2025-10-27T15:48:29Z

+        </code>
+        <code title="Invalid: Using functions to obfuscate code.">
+        <![CDATA[
+<em>eval( </em>base64_decode( $code_str )<em> )</em>;


I believe eval() is not flagged by the sniff so it should not be highlighted. More broadly, I'm not sure if it needs to be included as the sniff will trigger anyway for base64_decode() regardless of whether eval() is used.

rodrigoprimo · 2025-10-27T15:52:30Z

+        <![CDATA[
+<em>eval( </em>base64_decode( $code_str )<em> )</em>;
+<em>convert_uudecode( $uuencoded )</code>em>;
+<em>str_rot13( $rot13_encoded )</em>;


I migth be missing something but the name of this variable is a bit misleading to me as the function does not expect a ROT13 version of a string as it first parameter. Instead it will return a ROT13 version of a string.

rodrigoprimo · 2025-10-27T15:53:43Z

Thanks for working on the remaining remarks I had left in this PR, @jasonkenison. I checked everything and left a few follow up questions.

As I'm not a maintainer on this repo, I don't have permission to resolve the conversations for the things that you already addressed. For those, I left a thumbs up reaction on the last comment. Could you please resolve them?

rodrigoprimo · 2026-02-03T19:07:50Z

@jasonkenison, just checking if you are still available/interested in finishing this PR? Let me know if you have any questions about the feedback that I left. Thanks!

rodrigoprimo · 2026-03-30T13:10:01Z

@jasonkenison, please let us know within a week if you are still interested in finishing this PR. If we don't hear back from you, we will presume you don't have time, and we will see if we can find someone else to take over and finish it. Thanks for your work so far!

jasonkenison · 2026-03-30T15:09:57Z

@rodrigoprimo I think some of the PHP stuff I don't ever use (that this sniff is saying we shouldn't use) is beyond me. Might be ideal to pass this off to someone more familiar with these function. Thanks.

rodrigoprimo · 2026-03-31T09:22:32Z

No worries, and thanks for your response and the work you did, @jasonkenison!

tikifez and others added 4 commits September 17, 2024 15:20

adds documentation for sniff

b91fb4f

updated formatting, indentation, add tags

d12e715

update indentation, add , linebreak end of document

46f08e3

include more details in obfuscate code standard

a8fffd4

rodrigoprimo added Component: Extra Type: Documentation labels Aug 26, 2025

jrfnl changed the title ~~jasonkenison:Docs/word press.php.discouraged php functions~~ [Update] Documentation for sniff WordPress.PHP.DiscouragedPHPFunctions Aug 26, 2025

jrfnl mentioned this pull request Aug 26, 2025

Add documentation for each sniff #1722

Open

61 tasks

rodrigoprimo added Status: Awaiting feedback and removed Status: Awaiting feedback labels Sep 1, 2025

rodrigoprimo reviewed Sep 4, 2025

View reviewed changes

rodrigoprimo added the Status: Awaiting feedback label Sep 4, 2025

jasonkenison added 2 commits September 14, 2025 10:39

requested changes

b5a5872

fix spelling error

013e0d0

requested updates

5613680

rodrigoprimo reviewed Oct 27, 2025

View reviewed changes

Uh oh!

Conversation

jasonkenison commented Aug 26, 2025 • edited by jrfnl Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jasonkenison commented Aug 26, 2025

Uh oh!

rodrigoprimo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rodrigoprimo commented Oct 24, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rodrigoprimo commented Oct 27, 2025

Uh oh!

rodrigoprimo commented Feb 3, 2026

Uh oh!

rodrigoprimo commented Mar 30, 2026

Uh oh!

jasonkenison commented Mar 30, 2026

Uh oh!

rodrigoprimo commented Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jasonkenison commented Aug 26, 2025 •

edited by jrfnl

Loading