Title: PHP code injection does not work after newest update
Last modified: July 23, 2023

---

# PHP code injection does not work after newest update

 *  Resolved [june01](https://wordpress.org/support/users/june01/)
 * (@june01)
 * [2 years, 10 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/)
 * Hi,
 * After the newest update my php code injection is not working anymore. Do I need
   to change anything?

Viewing 13 replies - 1 through 13 (of 13 total)

 *  Plugin Author [Stefano Lissa](https://wordpress.org/support/users/satollo/)
 * (@satollo)
 * [2 years, 10 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-16916208)
 * Uhm, actually not, maybe you don’t have the PHP execution option active?
 *  [webdeweb](https://wordpress.org/support/users/webdeweb/)
 * (@webdeweb)
 * [2 years, 10 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-16916255)
 * Same… I downgraded to 3.2.5, I’m using php8
 *     ```wp-block-code
       <?php
       echo "Today: " . date( 'd-M-Y H:i:s', current_time( 'timestamp', 0 ) );
       ?>
       <br>
       <?php
       echo "International: " . date( 'd-m-y H:i:s', current_time( 'timestamp', 1 ) );
       ?>
       <br>
       Renew date and time: 
       <?php 
       the_date();  - the_time('l'); 
       ?>
       ```
   
    -  This reply was modified 2 years, 10 months ago by [webdeweb](https://wordpress.org/support/users/webdeweb/).
 *  Plugin Author [Stefano Lissa](https://wordpress.org/support/users/satollo/)
 * (@satollo)
 * [2 years, 10 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-16916918)
 * Hi, check on the plugin configuration, advanced tab, if the PHP is enabled. That
   option was introduced to conform with WP security standard (probably it will 
   be removed and the ability to execute PHP moved to a special “define” on wp-config.
   php)
 *  Thread Starter [june01](https://wordpress.org/support/users/june01/)
 * (@june01)
 * [2 years, 10 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-16916992)
 * can I activate it for the whole network ?
 *  [benmyhre](https://wordpress.org/support/users/benmyhre/)
 * (@benmyhre)
 * [2 years, 10 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-16927208)
 * > hat option was introduced to conform with WP security standard (probably it
   > will be removed and the ability to execute PHP moved to a special “define” 
   > on wp-config.php)
 * Please note that if you do that without some sort of automation or some very 
   clear notification, sites will break.
 *  Plugin Author [Stefano Lissa](https://wordpress.org/support/users/satollo/)
 * (@satollo)
 * [2 years, 10 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-16927438)
 * Hi, there is an automation that enables it automatically on update, but probably
   it is not working, or in some systems the update code is not working/executed,
   I’m looking at it.
 *  [Tyler Tork](https://wordpress.org/support/users/tylertork/)
 * (@tylertork)
 * [2 years, 10 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-16934002)
 * I also had this problem. You message “explaining” this issue blames the theme
   or plugins (“PHP is NOT allowed in your code (disabled by your theme or a plugin)”).
   This had me running down a rabbit hole for HOURS trying to figure out which plugin
   was the problem, when YOUR plugin was the problem. Even if the update had worked
   perfectly, this is really obnoxious. Please take the trouble to write clear messages.
 *  [keyinora](https://wordpress.org/support/users/keyinora/)
 * (@keyinora)
 * [2 years, 10 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-16939204)
 * Want to also add some additional information. It appears that the recent update
   included this new field, but you have it set it to disabled by default. (Which
   is causing the issues many are reporting) Would you be able to update it so its
   active by default?
 *  [leapdragon](https://wordpress.org/support/users/leapdragon/)
 * (@leapdragon)
 * [2 years, 10 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-16939865)
 * This is a serious bug.
 * There should have been a warning.
 * PHP is used to manipulate data, and as a result, we have some cookie data for
   users that was set to PHP code strings.
 * Luckily we do most of our data cooking in dedicated plugins of our own, but we
   did have some items in A/B testing using this plugin and those user cookies are
   now polluted.
 * But it took us some time to track down the issue. We noticed the change in this
   plugin’s settings, but when we set the option it did not appear to resolve the
   problem. It took us some time to realize that PHP strings were now stored in 
   cookies and being pulled back into the page environment. We have now had to implement
   new code to check cookies for PHP code and zero values if they contain PHP code.
   So we had to write net new code to undo what the change in defaults did on our
   site, and we have lost user data.
 * NEVER release a change in fundamental behavior unless you:
    - DEFAULT to old behavior and make the new behavior an option
    - Provide a WARNING prior to upgrade about what will change; word press provides
      a space for banners in the plugin list for this reason
 *  [sjc999](https://wordpress.org/support/users/sjc999/)
 * (@sjc999)
 * [2 years, 9 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-16990619)
 * Why the message “PHP is NOT allowed in your code (disabled by your theme or a
   plugin)” when it your own plugin that is disabling it. It’s bad enough to change
   the default so people’s sites break – but making them think this is coming from
   elsewhere – not your own settings – is really bad form.
 *  [tazcrzy](https://wordpress.org/support/users/tazcrzy/)
 * (@tazcrzy)
 * [2 years, 9 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-17020670)
 * Can someone educate me how to downgrade the version of the plugin, as I am having
   the same issue.
 *  Plugin Author [Stefano Lissa](https://wordpress.org/support/users/satollo/)
 * (@satollo)
 * [2 years, 7 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-17165205)
 * To enable PHP there is an option on the advanced tab.
 *  [spreaditunlimited](https://wordpress.org/support/users/spreaditunlimited/)
 * (@spreaditunlimited)
 * [2 years, 3 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-17450148)
 * [@satollo](https://wordpress.org/support/users/satollo/)
 * You need to change the error message from – PHP is NOT allowed in your code (
   disabled by your theme or a plugin)
 * to – PHP is NOT allowed in your code (go to Advanced tab to enable it)
 * Stop misleading us, wasting our time disabling and enabling other plugins when
   the solution is just a few tabs away.
 * This took me one day to fix, checking things I shouldn’t check on my server and
   wordpress, wasting my time when all I needed to do is go to advanced tab to enable
   it.
    -  This reply was modified 2 years, 3 months ago by [spreaditunlimited](https://wordpress.org/support/users/spreaditunlimited/).

Viewing 13 replies - 1 through 13 (of 13 total)

The topic ‘PHP code injection does not work after newest update’ is closed to new
replies.

 * ![](https://ps.w.org/header-footer/assets/icon-256x256.png?rev=3452717)
 * [Head, Footer and Post Injections](https://wordpress.org/plugins/header-footer/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/header-footer/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/header-footer/)
 * [Active Topics](https://wordpress.org/support/plugin/header-footer/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/header-footer/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/header-footer/reviews/)

 * 14 replies
 * 10 participants
 * Last reply from: [spreaditunlimited](https://wordpress.org/support/users/spreaditunlimited/)
 * Last activity: [2 years, 3 months ago](https://wordpress.org/support/topic/php-code-injection-does-not-work-after-newest-update/#post-17450148)
 * Status: resolved