WordPress has unique plugin architecture. Plugins are simply php files which are included (and executed) before any php pages which renders the content, whether it is your blog page or syndication feed or even administrative functions.

The plugins can do anything that is allowed by php code, including trashing your hard-disk to sending your bank account details to a cracker etc. Plugins do not operate under any restrictions. Nor can the product recover from errors generated by any plugin. I really miss here Java's strong security infrastructure.

Still fine and dandy untill you discover to your horror how a poorly coded plugin can bring down your site in no time.

Couple that with php's "silent treatment" of errors. In other words you and your viewers are greeted with a nice looking, white in color web page, whenever any (plugin) error occurs. Plugin errors could be as simple as having blank spaces at the end of plugin files after ?> to more complex ones like invalid argument to methods.
Update: Please check tips on making your plugins robust.

Pages: 1 2