AI WordPress code snippet generator(codewp.ai)
codewp.ai
AI WordPress code snippet generator
https://codewp.ai/
22 comments
For what it's worth, while this code generator might not be great, github copilot is pretty damn good at handling wordpress already (no need to specialize it for a specific thing I guess).
We wrote about ~85% of our relatively simple Wordpress plugin[1] using Copilot with no prior WP knowledge, it took maybe 2 hours at most, it's pretty decent and works well, clients are happy. Just had to write a 3-4 line comments of exactly what we wanted, it got it almost right on the first try, it was able to handle writing and reading configuration from the database as well. The only thing it struggled with was posting binary file content which is understandable.
1: https://www.faceshape.com/docs/integrations/wordpress to see the code if interested.
We wrote about ~85% of our relatively simple Wordpress plugin[1] using Copilot with no prior WP knowledge, it took maybe 2 hours at most, it's pretty decent and works well, clients are happy. Just had to write a 3-4 line comments of exactly what we wanted, it got it almost right on the first try, it was able to handle writing and reading configuration from the database as well. The only thing it struggled with was posting binary file content which is understandable.
1: https://www.faceshape.com/docs/integrations/wordpress to see the code if interested.
Neat.
post_with_file() in api.php makes me squinty. There's a lot of dead code in there; unless I'm missing something, that function is only called from infer_faceshape(), and that function is passing a harcoded empty array for the second parameter, which means the foreach(...) loop in it never fires. Ditto for the $filename parameter and the conditional that handles it. I'd also raise some concern about passing $file_path directly to your post data; WP core does some upload filename sanitation, I think, but I don't recall how much or how good it is (or isn't), and anyone that can reach your post_with_file() function might be able to post arbitrary data to your API endpoint (but maybe your API is robust enough that that's not a big deal). WP core has some functions for handling file uploads and filename sanitation that might be helpful here, e.g.: https://developer.wordpress.org/reference/functions/media_ha...
If your plugin is only storing an API key and another setting or two, the best practice is to use WP's options API instead of creating your own table: https://codex.wordpress.org/Options_API
Overall though, Copilot produced some code that's pretty darn standard for the WP community, and knocking it out in 2 hours starting from scratch is way more efficient than I could (or would want to) knucklebust it myself. Cool!
post_with_file() in api.php makes me squinty. There's a lot of dead code in there; unless I'm missing something, that function is only called from infer_faceshape(), and that function is passing a harcoded empty array for the second parameter, which means the foreach(...) loop in it never fires. Ditto for the $filename parameter and the conditional that handles it. I'd also raise some concern about passing $file_path directly to your post data; WP core does some upload filename sanitation, I think, but I don't recall how much or how good it is (or isn't), and anyone that can reach your post_with_file() function might be able to post arbitrary data to your API endpoint (but maybe your API is robust enough that that's not a big deal). WP core has some functions for handling file uploads and filename sanitation that might be helpful here, e.g.: https://developer.wordpress.org/reference/functions/media_ha...
If your plugin is only storing an API key and another setting or two, the best practice is to use WP's options API instead of creating your own table: https://codex.wordpress.org/Options_API
Overall though, Copilot produced some code that's pretty darn standard for the WP community, and knocking it out in 2 hours starting from scratch is way more efficient than I could (or would want to) knucklebust it myself. Cool!
Thanks for these pointers, will look into improving it!
Brian is very glad to see this. I am not your broker, but this contains three vulnerabilities that I can see. Seriously my dude/dudette, have you vetted this at all? I am no longer a pentester, but you have at least 2 ways to do RCE. Please don't post this again.
Which part would lead to RCE? Any pointers would be appreciated.
I find their marketing to be rather disagreeable: "No more expensive developers, or tedious StackOverflow searches." At best, this just changes the expertise that is useful to have (as well as the content of the StackOverflow searches that will still be made).
Still an interesting piece of software.
Still an interesting piece of software.
> No more expensive developers, or tedious StackOverflow searches.
Is't it quite ironic, that somehow this product statement is sneering on the exact kind of people ("expensive developers") that are required to build the product itself?
Is't it quite ironic, that somehow this product statement is sneering on the exact kind of people ("expensive developers") that are required to build the product itself?
There are no two ways around it: the people who wrote that copy are fucking clueless about what they’re selling and why. It better be a misguided agency or freelancer who wrote it because if it was the founders, it’d reveal a massive lack of product vision.
I think it's cool, but $8/mo is outrageous. I also hate the demo model, why not just limit my account to 5 queries or something so I can see how it works? Most WP code people deal with are simple loops that people just have saved elsewhere. Rarely do you need something crazily complex. Honestly a CSS/HTML ai generator would be incredible.
> but $8/mo is outrageous
It's outrageously cheap.
Wordpress plugins are insanely expensive, yet businesses will not hesitate to install dozens of them. $8 / month is a rounding error for most web agencies developing WordPress websites.
People would pay $49 a month for that crap.
It's outrageously cheap.
Wordpress plugins are insanely expensive, yet businesses will not hesitate to install dozens of them. $8 / month is a rounding error for most web agencies developing WordPress websites.
People would pay $49 a month for that crap.
$8/mo for something that is just a snippet tool is outrageous for how limited it is at the moment. As I said most WP development is simple loops, and for advanced development you aren't going to use an AI tool like this (especially given its bad coding example snippets.) A plugin like Advanced Custom Fields is worth the price because it's very high quality, so of course that's worth it. This is also not overly unique, GenerateWP for example already has some of this for free. https://generatewp.com/
And for more advanced stuff, you already have co-pilot, if you wanted something similar.
And for more advanced stuff, you already have co-pilot, if you wanted something similar.
> Most WP code people deal with are simple loops that people just have saved elsewhere.
I wonder if that's how this product got started - "most Wordpress plugin code are simple loops that get and do something on data" - and the only missing piece was to build a English language parser that takes that instruction and converts it into Wordpress PHP code that implements that request.
I wonder if that's how this product got started - "most Wordpress plugin code are simple loops that get and do something on data" - and the only missing piece was to build a English language parser that takes that instruction and converts it into Wordpress PHP code that implements that request.
I like this "no-code" approach to website building.
it has that "without coding" aspect, without being captive to these "no-code" website builders out there.
Maybe your point is lost on me but AI “copilots” are still super high-code.
What I meant is: it is true you will still have to know how to read, integrate (and edit) the generated code, but you will {no[t] code} it yourself (see that no-code there).
I'm not very familiar with current AI “copilots” performance, and I'm more thinking in term of the "ideal" code generator (= good output)
It may seem like a stretch, but I’m one of those who dislike coding everything A-Z while still acquiescing to editing (good) code and enjoing integrating it.
I'm not very familiar with current AI “copilots” performance, and I'm more thinking in term of the "ideal" code generator (= good output)
It may seem like a stretch, but I’m one of those who dislike coding everything A-Z while still acquiescing to editing (good) code and enjoing integrating it.
> We trained CodeWP on WordPress PHP
Imagine having that as a selling point lol.
Imagine having that as a selling point lol.
Has a spelling mistake: “Prompt CodeWP For Anthing WordPress”
>We trained CodeWP on WordPress and WooCommerce
So this AI is entirely trained on GPL code?
Wouldn't that make it a derivative work subject to GPL licensing?
So this AI is entirely trained on GPL code?
Wouldn't that make it a derivative work subject to GPL licensing?
...well, it's certainly not making the WordPress community codebase worse.