devFAIL

Not that it surprises me that much, but there are some truly bizarre chunks of code in WordPressMU. Check out this hot piece of love:

$wpdb->query( "UPDATE $wpdb->usermeta SET meta_value = 'a:1:{s:" . strlen( $role ) . ":\"" . $role . "\";b:1;}' WHERE user_id = '$userid'  AND meta_key = '" . $wpdb->base_prefix . $id . "_capabilities'" );

Yeah that’s right, a manually constructed string, representing a serialized array. WTF?