Wordpress was first released in 2003. There wasn't a database abstraction layer for PHP at the time (PDO was first released in 2005), so it was tightly coupled to MySQL.

And PDO isn't even a proper database abstraction layer, it's just a way to connect to various databases and issue prepared statements. You still have to write your own SQL queries and create table statements, which will most certainly not be portable.

Fair. It's 2022 now. I figured in the 19 years since they would have done something like this.

They’ve consistently prioritized backwards compatibility over pretty much anything else.

It doesn't even use placeholders and prepared statements. What looks like prepared statements, for example, are not.

Behold: https://github.com/WordPress/WordPress/blob/master/wp-includ...

This is wild and hard to believe nobody has found a way to do some sql injection from there