PHP Code Widget
Like the Text widget, but also allows working PHP code to be inserted.
The facts
- Rating
- 4.7★ from 61
- Active installs
- 70k+
- Price
- Free
- Last updated
- 30 Mar 2022
- Added
- Mar 2008
- Requires WP
- 2.8
- Tested up to
- WP 5.9.16
- Downloads
- 999,198
Our analysis
AI-assistedPHP Code Widget is a WordPress plugin that allows you to insert and execute PHP code within a text widget. It enhances the standard Text widget by parsing and executing PHP code enclosed in standard opening and closing tags. This functionality can assist users in transitioning to widget-based themes.
However, the plugin poses security risks, as it enables anyone with access to edit widgets to execute arbitrary PHP code. It is recommended for temporary use rather than long-term implementation.
Best for: This plugin is suitable for developers or users needing to execute PHP code in text widgets temporarily.
What it does well
- ✓Allows execution of PHP code in text widgets
- ✓Facilitates migration to widget-based themes
- ✓Restricts unfiltered HTML and PHP code execution to users with specific roles
Where it falls short
- •Potential security risk if widget access is not properly managed
- •Not recommended for long-term use
Verdict
PHP Code Widget provides useful functionality for specific scenarios but carries security risks that should be carefully considered.
From the developer
Samuel Wood (Otto)'s own description of PHP Code Widget, lightly tidied.
The normal Text widget allows you to insert arbitrary Text and/or HTML code. This allows that too, but also parses any PHP code in the text widget and executes it.
This can make it easier to migrate to a widget-based theme. However, this plugin should not be used long term, as anybody with access to edit the widgets on your site will be able to execute arbitrary PHP code.
All PHP code must be enclosed in the standard php opening and closing tags ( <?php and ?> ) for it to be recognized and executed.
Only users with the unfiltered_html role will be allowed to insert unfiltered HTML. This includes PHP code, so users without admin or editor permissions will not be able to use this to execute code, even if they have widget editing permissions.