Skip to content

Instantly share code, notes, and snippets.

@jonlambert
Last active August 29, 2015 14:07
Show Gist options
  • Save jonlambert/468513f16b2431c886b5 to your computer and use it in GitHub Desktop.
Save jonlambert/468513f16b2431c886b5 to your computer and use it in GitHub Desktop.
Changing the database table prefix in Wordpress does NOT increase security.
<?php
/**
* This code may not work, it's pretty much pseudocode, as I'm presuming get_results() will return an array of tables. I don't have a Wordpress installation to test it!
* The idea is correct though, and the command `SHOW TABLES` will 100% return a list of tables in the database.
*
* But for arguments sake, lets assume the format returned is as below.
*/
function getWordpressTablePrefix() {
$tables = $wpdb->get_results("SHOW TABLES");
foreach ($tables as $table) {
$output = array();
if (preg_match("/(.*)_users/i", $table, $output)) {
return $output[1];
}
}
}
/**
* Calling `getWordpressTablePrefix()` *will* return the prefix used by this installation (for example, 'wp' or 'more_secure_wp').
*
* It is dangerous to assume changing the table prefix will keep you safe from anybody that's achieved database injection.
*/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment