New to the community? Start here

How to allow PHP in widget? Does Exec-PHP plugin work on WPMU?

I’m not worried about security, but I need to allow php code to execute in a widget. What’s the best way?

I really only need that support in widgets, but I don’t care if the solution also works in posts and pages.

The developer of Exec-PHP plugin doesn’t seem to know if it works with MPMU. Anyone here using that? If so, does it go into the mu-plugins directory?

Thu, 21 May 2009 23:44:12
  • Ovidiu
    • Code Wrangler

    well, its obvious: open the plugin files and check: is any path hardcoded? Is it specifically looking for wp-content/plugins? If so change to mu-plugins. If not, use it from mu-plugins folder.

    But you know this is dangerous, right? Do you really need php execution in widgets for all blgos?

  • drmike
    • DEV MAN’s Mascot

    There’s a couple of threads on exec-php on the mu forums. I don;t think anyone ever got it to work in wpmu. Most of us were suggesting that, if you’re not worried about security, just removing the necessary bits from kses or even the kses check from widgets:

    http://mu.wordpress.org/forums/topic/7009

    Have to admit that I would rather just code up a widget that does what you need. Probably quicker and you don’t have to be concerned about security holes or someone else placing code that they shouldn’t, even if they’re trusted users.

  • Robert
    • Flash Drive

    I will make a custom widget eventually. But, right now I needed a quick and dirty solution for a proof-of-concept system.

    If anyone is curious, I dropped the Exec-PHP widget into wp-content/plugins and it works fine. I’ve only done limited testing in a no-traffic environment, but I don’t see anything broken. THIS IS DEFINITELY NOT RECOMMENDED FOR A PRODUCTION SYSTEM.

    I did read those threads about kses and they left me more confused. Lots of talk about old versions of wpmu, and whether widgets or kses is built in or not. I’ll circle back and figure that out eventually, but for now it was easier to copy exec-php and move on.