Digging into WordPress » PHP

Clean Up “Cannot redeclare” Hack

Jeff Starr — Fri, 18 Nov 2011 22:44:09 +0000

One of my clients was hacked with the so-called “Cannot redeclare” hack. It seems closely related to the nefarious TimThumb hack, so if you’ve been hit by either of these hacks, you should check for the other. Apparently these hacks affect shared servers, so if you host multiple WordPress sites, chances are high that they’re all infected.

Checking for the “Cannot redeclare” hack

The good news is that the hack is easy to diagnose. Just open any page from your site and look for the following PHP error message:

Fatal error: Cannot redeclare _765258526() 
(previously declared in /path/to/www/wp-content/themes/THEME/footer.php(12) 
: eval()'d code:1) in /path/to/www/index.php(18) 
: eval()'d code on line 1

PHP errors like this are usually located at the bottom of the web page, but may appear elsewhere or even not all in some cases (i.e., proper configuration). To be certain, scan your server’s PHP error logs for the “Cannot redeclare” error string. If you find anything that matches, it’s time to fix your site..

About the “Cannot redeclare” hack

If your site’s been hit with “Cannot redeclare”, you’re in for a wild clean-up party because it infects every index.php and footer.php file for every WordPress site on the server.

For example, my client hosted 11 sites on the same shared account, so multiply that by the number of index and footer files used by WordPress (core files and themes) and you get over 200 hacked files to clean up. Needless to say the client’s sites have been moved to a more secure location.

Fortunately finding the hacked index files is relatively painless, just search all files on your server for the following phrase:

eval(gzun

Here is a screenshot showing search results for this phrase:

As seen here, the hacked files should be easy to recognize because they:

include the eval(gzun search term
include long strings of encoded gibberish
consist of index.php and footer.php files

If your search turns up anything that similar but not quite what we’re talking about here, it may or may not be legit. The main thing that we’re looking for are the long strings of encoded nonsense. Also, remember to check all sites that you may have on the same server. Once you’ve isolated the infected files, it’s time to clean ‘em up..

Removing the “Cannot redeclare” hack

Looking at any of the hacked files, you’ll find this hideous looking piece of code garbage:

Disgusting stuff, and if you don’t see it at first, that doesn’t mean it’s not there. The scumbags who deal in this filth are clever enough to indent the code so it appears off-screen (via horizontal scrollbar). It’s a clever trick, but most text editors have a limit to the number of characters that appear on each line, so the super-long string of encoded gibberish wraps and becomes easy to spot:

Notice it there in the last line.. it’s like that for all teh files. And again, if you don’t see anything then look for it off-screen. Once you find it, delete it. Then repeat for all index and footer files on your server. Once you’ve done that the “Cannot redeclare” hack should be gone, but you should take steps to prevent future attacks..

Securing your WordPress site

For public websites, there is no such thing as perfect security. There are many ways to improve security, however, including finding a more secure host for your sites. In general, private or some sort of virtual private hosting is better than shared hosting (for many reasons), but it’s also more expensive. Hosting is one of those things where you get what you pay for.. so if you have the means, upgrading to a better, more secure host is the first thing I would consider.

Beyond switching hosts, there are a number of known effective measures you can take to improve the security of your site. There are many excellent resources available to help with site security (both for WordPress and in general), including an entire Lynda.com video/screencast series that focuses in-depth on devloping secure WordPress sites. Even more recently is Daniel Pataki’s Smashing WP article on securing your WordPress website. And if you want to hear it direct from the horse’s mouth, check out the good ‘ol fashioned WP Codex for info on hardening WordPress.

More help..

There’s currently not a lot of info on the “Cannot redeclare” hack, but this WP Forum thread provides some additional clues. If you have any information regarding this hack, or how it relates to the TimThumb hack, please leave a comment to share the information with others in the WP community. Thanks.

Import Feed, Display in Multiple Columns

Jeff Starr — Tue, 27 Sep 2011 16:24:49 +0000

Recently I worked on a project where a single RSS feed was imported and displayed in multiple columns on the web page. Certain pages display feed items in two columns, others in groups of three or more. This technique uses WordPress’ built-in fetch_feed functionality to parse external feeds, and a slice of PHP magic to display them in multiple columns. It’s flexible too, enabling any number of columns and feed items from anywhere in your theme/template files. For example, you could display any of the following:

10 feed items split into two columns of five
30 feed items split into three columns of 10
30 feed items split into five columns of six

Notice the pattern? The key to showing the same number of posts in each column is to set the total number of feed items as a multiple of the total number of columns. Before explaining how that works, let’s back up a bit and get fetch_feed() set up..

Setting up fetch_feed()

To display feeds in multiple columns, use WordPress’ fetch_feed function, set up like this anywhere in your theme template files:

init();
		$feed->set_output_encoding('UTF-8');	// set encoding
		$feed->handle_content_type();		// ensure encoding
		$feed->set_cache_duration(21600);	// six hours in seconds
		$limit = $feed->get_item_quantity(10);	// get 10 feed items
		$items = $feed->get_items(0, $limit);	// set array
	endif;
} ?>

There are three things to configure:

feed URL – replace http://example.com/feed/ with the feed URL
cache duration – change if needed, default is six hours (in seconds)
number of feed items – should be some multiple of the number of columns

So for example, getting 10 feed items would enable us to display 1, 2, 5, or 10 columns, with the same number of feed items in each column. So, to display a feed evenly across three columns, some multiple of three is required for the number of feed items. So that would be 3, 6, 9, 12, and so on – basically any number divisible three.

Read more about the other fetch_feed variables at the WordPress Codex.

Setting up array_slice()

Once fetch_feed() is set up, we have an array of $items containing our feed content. To display the items in multiple columns, we use PHP’s incredibly useful array_slice function, which enables us to extract slices of the feed array. The array_slice function accepts three basic parameters, the input array, offset, and length:

array_slice($array, $offset, $length);

Using the $items array generated from the fetch_feed() function, we calculate the other two array_slice variables depending on the total number of columns and feed items. So for the sake of simplicity, let’s say we want to display two columns each with five feed items. The PHP would look something like this:

// display first five feed items
$blocks = array_slice($items, 0, 5); // grab first five items from the array
foreach ($blocks as $block) {
	echo $block->get_title();
	echo $block->get_description();
}

// display next five feed items
$blocks = array_slice($items, 5, 10); // grab next five items from the array
foreach ($blocks as $block) {
	echo $block->get_title();
	echo $block->get_description();
}

Likewise, to display 30 feed items in three columns of 10 each, we would create three foreach loops using the following array_slice values:

$blocks = array_slice($items, 0, 10); // first column
$blocks = array_slice($items, 10, 20); // second column
$blocks = array_slice($items, 20, 30); // third column

As you can see, the key to displaying external feeds in multiple columns is configuring array_slice with the correct $offset and $length parameter values. Once you’ve got that dialed in, you’re ready to put it all together and make it happen.

Displaying feed items

Notice in the previous section that we use the following to display feed items in each column:

echo $block->get_title();
echo $block->get_description();

That’ll display the title and description for each feed item, but you can do much more than that. Here is a more elaborate example showing how different feed items may be included in the markup:


	get_title(); ?>
	
		get_date("l, F jS, Y"); ?>
		get_description(), 0, 200); // limit to 200 characters ?> 
		Continue reading

For each feed item in the loop, this snippet displays the following:

Title of the feed item, linked to the post URL
Content of the feed item, truncated to 200 characters
A “Continue reading” link, linked to the post URL
Each feed item is wrapped with

There is much more available for customizing your imported feeds, see the SimplePie documentation and more specifically the item-level data methods for all the details.

Putting it all together

Here is the final code for displaying external feed content in multiple columns:

init();
		$feed->set_output_encoding('UTF-8');	// set encoding
		$feed->handle_content_type();		// ensure encoding
		$feed->set_cache_duration(21600);	// six hours in seconds
		$limit = $feed->get_item_quantity(10);	// get 10 feed items
		$items = $feed->get_items(0, $limit);	// set array
	endif;
}

if ($limit == 0) { 
	echo 'RSS Feed currently unavailable.'; 
} else {
	// display first five feed items
	$blocks = array_slice($items, 0, 5);
	foreach ($blocks as $block) { ?>
		
			get_title(); ?>
			
				get_date("l, F jS, Y"); ?>
				get_description(), 0, 200); ?> 
				Continue reading
			
		
	

	// display next five feed items
	$blocks = array_slice($items, 5, 10);
	foreach ($blocks as $block) { ?>
		
			get_title(); ?>
			
				get_date("l, F jS, Y"); ?>
				get_description(), 0, 200); ?> 
				Continue reading

As-is, this code displays two columns of five feed items each. Using the techniques and info presented in this article, it’s possible to configure this code to display any number of feed items in any number of columns. This code works when placed in just about any theme template file that makes sense. Probably best when placed outside of the WordPress post loop.

Note that we also verify the feed is available before trying to display anything. After setting up fetch_feed(), we inject the following PHP logic:

if ($limit == 0) { 
	echo 'RSS Feed currently unavailable.'; 
} else {
	// display first five feed items
	// display next five feed items
}

This ensures that no empty markup tags are echoed to the browser if/when the feed is unavailable. It happens, so checking is a good move.

Instant Summary

Using array_slice() together with fetch_feed(), it’s possible to display any number of feed items in any number of columns. This provides much design flexibility for your project.

3 Ways to Reset the WordPress Loop

Jeff Starr — Mon, 12 Sep 2011 16:28:23 +0000

WordPress does an excellent job of keeping track of what’s happening with the loop, but once you start customizing parameters and setting up multiple loops, it’s a good idea to explicitly reset them using one of three WordPress template tags. In this DiW post, we’ll explore these techniques to get a better understanding of when and how to use them in your WordPress themes.

wp_reset_postdata()

First up we have wp_reset_postdata, which restores the global $post variable to the current post in the main query. This is useful when using WP_Query to customize loops or create multiple loops on the same page. It looks like this:

This tag is nice and simple – it accepts no parameters and returns no values. It simply resets the post data after a custom query. So for example, let’s say we have a custom WP_Query loop in our theme’s header.php file, something like this:

$random_post = new WP_query(); 
$random_post->query('cat=3&showposts=1&orderby=rand'); 
while ($random_post->have_posts()) : $random_post->the_post(); 

	ID, 'featured', true); ?>">

endwhile;

This would display a random post in the header, but it will also change the main query object for any other loops on the page. Without the original query data available, the main posts loop contained in, say, index.php may produce unexpected results. Fortunately, we can use wp_reset_postdata to restore the query object to its original state.

To use wp_reset_postdata, just place after your custom loop(s). Here is our previous example with wp_reset_postdata to reset the loop:

$random_post = new WP_query(); 
$random_post->query('cat=3&showposts=1&orderby=rand'); 
while ($random_post->have_posts()) : $random_post->the_post(); 

	ID, 'featured', true); ?>">

endwhile;
wp_reset_postdata();

When to use: best used after custom or multiple loops created with WP_Query.

wp_reset_query()

Next up we have the wp_reset_query function, which resets the query used with custom loops. It’s a simple function that accepts no parameters and returns no values. It looks like this:

Specifically, this function was created to prevent issues with query_posts, as indicated for the function in the wp-includes/query.php file:

/**
 * Destroy the previous query and set up a new query.
 *
 * This should be used after {@link query_posts()} and before another {@link
 * query_posts()}. This will remove obscure bugs that occur when the previous
 * wp_query object is not destroyed properly before another is set up.
 *
 * @since 2.3.0
 * @uses $wp_query
 */

Looking at the wp_reset_query function in query.php, we see that it uses the adjacent wp_reset_postdata function to restore the global $post variable to the current post in the main query:

// destroy and reset the query
function wp_reset_query() {
	unset($GLOBALS['wp_query']);
	$GLOBALS['wp_query'] =& $GLOBALS['wp_the_query'];
	wp_reset_postdata(); // <-- RESET QUERY
}

// restore the query
function wp_reset_postdata() {
	global $wp_query;
	if ( !empty($wp_query->post) ) {
		$GLOBALS['post'] = $wp_query->post;
		setup_postdata($wp_query->post);
	}
}

So both wp_reset_query() and wp_reset_postdata() reset the query object by restoring the global $post variable, but wp_reset_query takes it a step further and actually destroys the previous query before doing so. This is important when using query_posts(), as seen in the following example:

When to use: best used after a query_posts loop to reset things after a custom query.

rewind_posts()

Last but not least, we have the rewind_posts function, which basically does what it says: rewinds the loop so you can re-use the same query. The function accepts no parameters, returns no values, and looks like this when used in your theme files:

So to understand when to use rewind_posts(), let’s say we want to use the same query in two different locations on the page. We want to display post titles in the first loop and post content in the second loop. To re-use the same posts, we include rewind_posts after the first loop, like so:

if (have_posts()) : while (have_posts()) : the_post(); ?>

So, while wp_reset_query and wp_reset_postdata reset the entire query object, rewind_posts simply resets the post count, as seen for the function in the wp-includes/query.php file:

// rewind the posts and reset post index
function rewind_posts() {
	$this->current_post = -1;
	if ( $this->post_count > 0 ) {
		$this->post = $this->posts[0];
	}
}

When to use: best for re-using the same query on the same page.

5-second summary

Quick summary for future reference:

wp_reset_postdata() -> best used after custom or multiple loops created with WP_Query
wp_reset_query() -> best used after a query_posts loop to reset a custom query
rewind_posts() -> best for re-using the same query on the same page

I hope this is a useful round-up of when & how to reset/rewind the WordPress loop. Note that the WP Codex information on these functions is kinda thin, so feel free to share any tips or examples in the comments.

Create an Articles-Only Feed

Jeff Starr — Wed, 24 Aug 2011 15:33:10 +0000

WordPress makes it easy to publish content in any number of categories, with any number of tags, and with any type of custom post format. So for example, in addition to full articles, you could also offer screencasts, links, side posts, tweets, and all sorts of other peripheral content. Complementary material may work great for visitors surfing around your site, but including all of that extra stuff in your RSS feed dilutes the potency of your main articles. The idea here is that your visitors will subscribe to the more focused content.

In this post, we create a custom, “articles-only” feed for visitors who want to subscribe to the main content only, without all the side stuff. The technique is actually pretty flexible, and works great to create just about any type of custom WordPress feed content. It’s pretty easy to do, requiring a whopping two steps to make it happen..

Step 1: Create the custom page template

Go to your theme directory and create a new PHP file named article-feed.php. Then add the following code (don’t worry it’s actually not that bad):

';
?>


>

	<?php bloginfo_rss('name'); wp_title_rss(); ?> - Article Feed
	
	
	
	
	
	
	
	
	
	

	
		<?php the_title_rss(); ?>
		
		
		
		

		


		]]>


		]]>
	post_content ) > 0 ) : ?>

		]]>
	

		]]>

This is basically just a typical WordPress feed template, but with some extra query action to make it do what we want. In the first few lines of code, we specify how many posts to display, which categories to include, and whether to display full posts or excerpts:

$numposts = 10; // number of posts in feed
$posts = query_posts('showposts='.$numposts.'&cat=3');
$more = 1;

Using this default code, the custom feed will show 10 posts from category 3. And with $more set to 1, the full article will be included in the feed. This is where you customize your new feed to include whatever you want. So for example, if we post articles in three different categories, say with IDs of 1, 2, and 3, we would modify our code to look like this:

$numposts = 10; // number of posts in feed
$posts = query_posts('showposts='.$numposts.'&cat=1,2,3');
$more = 1;

The query_posts function is quite flexible and provides all of the parameters needed to set up just about any customized feed content. You can exclude/include categories, display specific types of posts, change the number of posts displayed, and so much more. For a full list of options, check out query_posts at the WordPress Codex.

Step 2: Create the custom Page in the WP Admin

Once you have the custom Page Template uploaded to your server, log into the WordPress Admin and visit the “Add New Page” screen (Pages > Add New). Create a new page named “Articles-Only Feed” (or whatever), and select the newly added “articles” page template from the drop-down menu:

While you’re there in the Admin creating this new custom-feed page, take a moment to be mindful of the feed URL and title, which may be set to whatever works best:

Once everything is ready, finish it up by publishing the page to your site. Then check that your new feed is working by visiting the URL of the new page you just created in the WP Admin. Here at DigWP.com, our articles-only feed is available at http://digwp.com/articles/.

Wrap-up + additional resources

In addition to the easy-breezy two-step custom-feed tutorial in this post, here are some additional resources that are sort of related to this general topic:

4 Ways to Loop with WordPress

Jeff Starr — Wed, 11 May 2011 16:44:06 +0000

At the heart of the WordPress theme template is the venerable WordPress loop. When you’re looking at your index.php file, for example, the loop is the part that typically begins with if(have_posts()) and contains all the tags and markup used to generate the page. The default loop works perfectly well for most single-loop themes, but for more advanced designs with stuff like multiple and custom loops, more looping power is needed. Fortunately, WordPress provides plenty of flexibility with four ways to loop:

Default Loop
Loop with query_posts()
Loop with WP_Query()
Loop with get_posts()

Each of these looping methods is useful in a variety of situations. They share a lot of the same underlying functionality, and the query parameters are essentially the same. Collectively, these four techniques enable simple loops, multiple loops, and custom loops in your WordPress theme template. A good place to find a default loop, for example, is in your theme’s index.php file. Its purpose is to loop through the posts stored in the database and echo their contents to the browser. Using WordPress’ template tags, it’s easy to display post titles, content, meta info, and much more. That said, let’s examine the four ways to loop with WordPress.

The Default Loop

The default WordPress loop looks something like this:



	 id="post-">
		
		
	



	
		
		
	



	 id="post-">
		Not Found

So what makes it “default”? Mostly because it uses the default query to loop through post content, making it the loop used like 99% of the time for most themes. It tells WordPress to loop through posts and display the information according to context, and as called by the various template tags (the_title, the_content, et al). There are tags available for just about any type of data stored in the database.

Based on the query that is sent, the default loop will display a certain number of posts from a certain category from a certain date, and so on. For example, the number of posts displayed in the first part of the loop is specified in the WP Admin. So if someone requests the second page of your “Awesome” category, that information is sent via the query, along with the number of posts, theme template file, and so on.

So the default loop is perfect if you’re happy with the query that is sent, but it is also possible to customize the query and generate an entirely different set of posts.

Loop with query_posts()

The query_posts function enables us to modify the query and display our desired results. We can either override the entire query or keep it around and just change a few parameters. Here’s an example where query_posts is called before the default loop to exclude a specific category:

Say you have a default loop in your index.php theme template, but you want to change the number of posts, exclude two categories, and display the results in ascending order. Easy. Just add some query_posts action before the default loop and wp_reset_query immediately after, like this:

Here we are keeping the original query around and just overriding a few parameters. There are many parameters available, so customizing any default loop is accomplished quite easily. If we wanted to completely override the original query, we would replace the second line with something like this:

$posts = query_posts('posts_per_page=3&cat=-6,-9&order=ASC');

Notice here that we’ve removed the $query_string from the query_posts parameters. This essentially erases the default query and replaces it with one that contains only those variables included in query_posts. This means no paging information will be available, so remove the original query only if you know what you’re doing.

When to use? Use query_posts to modify the type of posts that are returned for a single loop. It’s perfect for limiting the number of posts, excluding posts from a certain category or tag, and so on. If more than one loop is required, multiple query_posts loops could work, but there is a much better way to do it using WP_Query.

Loop with WP_Query()

For complete control over the customization of any number of loops, WP_Query is the way to go. When used to modify a default loop, it looks similar to query_posts. For example, let’s exclude a specific category using WP_Query:

have_posts()) : $custom_query->the_post(); ?>

	 id="post-">

It also accepts the same parameters as query_posts, so modifying stuff like number of posts, included/excluded categories, and post order looks quite familiar. As seen in the following examples, WP_Query makes it easy to customize the loop by simply changing the parameter:

$custom_query = new WP_Query('cat=-7,-8,-9'); // exclude any categories
$custom_query = new WP_Query('posts_per_page=3'); // limit number of posts
$custom_query = new WP_Query('order=ASC'); // reverse the post order

As expected, we can combine parameters with WP_Query using the same syntax as both query_posts and get_posts. Here’s the equivalent of our query_posts example:

$custom_query = new WP_Query('posts_per_page=3&cat=-6,-9&order=ASC');

Notice, however, that with WP_Query, we don’t need the $query_string variable. In addition to using WP_Query to customize the default loop, we can also use it to create and customize multiple loops. Here is a basic example:

have_posts()) : $first_query->the_post();
...
endwhile;
wp_reset_postdata();

// Loop 2
$second_query = new WP_Query('cat=-2'); // exclude category
while($second_query->have_posts()) : $second_query->the_post();
...
endwhile;
wp_reset_postdata();

// Loop 3
$third_query = new WP_Query('cat=-3'); // exclude category
while($third_query->have_posts()) : $third_query->the_post();
...
endwhile;
wp_reset_postdata();
?>

Each of these additional loops may be placed anywhere in your theme template – no need to line them up sequentially. For example, one loop may be placed in your sidebar, another in your footer, and so on. And with the output of each loop easily modified using any of the available parameters, any loop configuration is possible.

When to use? Use WP_Query for creating multiple, customized loops. By setting up additional instances of WP_Query in your theme, you can create any number of multiple loops, and customize the output of each.

Even so, we don’t always need to break out the big guns, sometimes we just need a few additional loops displayed around the page. So let’s put down the bazookas and gather in the garden for some get_posts tea ;)

Loop with get_posts()

The easiest, safest way to create multiple loops in your theme is to use get_posts(). Anywhere you need to display a quick, static set of posts, get_posts is the perfect choice. Think 10 recent posts in the sidebar, or 10 random posts in the footer. get_posts makes it easy. Here again is a query to exclude a specific category:

 -9); // exclude category 9
$custom_posts = get_posts($args);
foreach($custom_posts as $post) : setup_postdata($post);
...
endforeach;
?>

This code creates a loop of all posts except those in the excluded category. Of course, excluding a category is just one way to customize your additional, static loops. By using any of the same parameters accepted by WP_Query and query_posts, it’s possible to create loops that display just about anything you want.

Notice, however, that get_posts requires the use of an array for the parameters. The format for multiple parameters looks like this (using our previous example):

$args = array('numberposts'=>3, 'category'=>-6,-9, 'order'=>'ASC');

Also notice that we’re using numberposts instead of posts_per_page to limit the number of posts. According to the WP Codex, posts_per_page should work with get_posts, but if it doesn’t just go with numberposts. There is also a showposts parameter that also seems to work fine with get_posts.

When to use? Use the get_posts() function to easily create additional, static loops anywhere in your theme. get_posts accepts the same parameters as query_posts, and is perfect for adding static, custom loops to your sidebar, footer, or anywhere else.

30-Second Summary

The bottom line for customizing default loops and creating multiple loops:

To modify the default loop, use query_posts()
To modify loops and/or create multiple loops, use WP_Query()
To create static, additional loops, use get_posts()

If you’re working with WordPress loops and want to learn more about using them to customize your theme, we cover the topic extensively in our book, Digging into WordPress, which is current with WordPress 3.1 :)

Ajax Requested Page Return Only Content

Chris Coyier — Wed, 02 Feb 2011 15:42:32 +0000

I posted a little tip on CSS-Tricks the other day about how you can load only parts of other pages on a site via Ajax, and how to do that without needing additional HTML wrapping elements to keep it clean. A common criticism of this is that the Ajax request still loads the entire page, using all that bandwidth, it’s just that it only places onto the page the part you specify via CSS selector.

Sometimes it’s hard to have discussions like this without looking at specific use case, but I see where they are coming from. Loading content you aren’t going to use is a waste of bandwidth. It does make progressive Ajax enhancements a lot easier though. And in fact, that’s how the ALL AJAX theme here on this site works.

This had me thinking though… if WordPress pages could be smart enough to know if they are being requested normally or via Ajax, they could return only the appropriate content. Turns out PHP can detect this. So here is the basic idea:



  /* This is Ajax: Return ONLY content */
  
  



  /* Normal request: Return everything (header, sidebar, content, etc) */

I haven’t tested this but it seems like a reasonable solution to me. Anyone have any experience trying something like this?

Specify Unique CSS File Per Post

Chris Coyier — Mon, 10 May 2010 21:20:39 +0000

I’m a HUGE fan of being able to link up a CSS file on a per-page basis. I just find it extremely common that a page needs CSS styling unique to it, and I hate litering a sites main stylesheet with customizations that only one particular page needs. We’ve talked about this before, and even created a custom method for doing so, as well as mentioned the art direction plugin, which makes this easily possible.

Both of those methods are still sweet, but I find in general that I like to write my CSS in actual CSS files I keep in my theme and can edit using whatever CSS editor I like, as well as keep things clean and simple in the admin. So, I’ve altered the technique a bit.

The idea is to add a simple text input to the page editor, right underneath the content area, where you can manually specify the name of a CSS file. In the image below, you can see I’ve also added one for JavaScript.

To add this to your site, it’s just some code to add to the functions.php file. Should work for any site.

// Custom Stylesheet box in Pages/Posts
add_action('admin_menu', 'digwp_custom_css_hooks');
add_action('save_post', 'digwp_save_custom_css');
add_action('wp_head','digwp_insert_custom_css');
function digwp_custom_css_hooks() {
	add_meta_box('custom_css', 'Name of custom CSS file', 'digwp_custom_css_input', 'post', 'normal', 'high');
	add_meta_box('custom_css', 'Name of custom CSS file', 'digwp_custom_css_input', 'page', 'normal', 'high');
}
function digwp_custom_css_input() {
	global $post;
	echo '';
	echo '';
}
function digwp_save_custom_css($post_id) {
	if (!wp_verify_nonce($_POST['custom_css_noncename'], 'custom-css')) return $post_id;
	if (defined('DOING_AUTOSAVE') && DOING_AUTOSAVE) return $post_id;
	$custom_css = $_POST['custom_css'];
	update_post_meta($post_id, '_custom_css', $custom_css);
}
function digwp_insert_custom_css() {
	if (is_page() || is_single()) {
		if (have_posts()) : while (have_posts()) : the_post();
		  $filename = get_post_meta(get_the_ID(), '_custom_css', true);
		  if ($filename) {
			echo "";
          }
		endwhile; endif;
		rewind_posts();
	}
}

If you are happy with just CSS only, you can stop there. If you would like the JavaScript box as well, here is that code.

// Custom JavaScript in Pages/Posts  (...lots of repeated code, could be better)
add_action('admin_menu', 'digwp_custom_js_hooks');
add_action('save_post', 'digwp_save_custom_js');
add_action('wp_head','digwp_insert_custom_js');
function digwp_custom_js_hooks() {
	add_meta_box('custom_js', 'Name of custom JavaScript file', 'digwp_custom_js_input', 'post', 'normal', 'high');
	add_meta_box('custom_js', 'Name of custom JavaScript file', 'digwp_custom_js_input', 'page', 'normal', 'high');
}
function digwp_custom_js_input() {
	global $post;
	echo '';
	echo '';
}
function digwp_save_custom_js($post_id) {
	if (!wp_verify_nonce($_POST['custom_js_noncename'], 'custom-js')) return $post_id;
	if (defined('DOING_AUTOSAVE') && DOING_AUTOSAVE) return $post_id;
	$custom_js = $_POST['custom_js'];
	update_post_meta($post_id, '_custom_js', $custom_js);
}
function digwp_insert_custom_js() {
	if (is_page() || is_single()) {
		if (have_posts()) : while (have_posts()) : the_post();
		    $filename = get_post_meta(get_the_ID(), '_custom_js', true);
		    if ($filename) {
			 echo "";
            }
		endwhile; endif;
		rewind_posts();
	}
}

You could probably combine these together a bit better than I have done here, it’s a bit redundant.

How it Works

There are three things going on here, which tap into three existing WordPress “hooks”.

Adds text inputs to the page editing screen of the admin using the admin_menu hook and the add_meta_box function
Save the values of those text inputs when the page is saved using the save_post hook
Output or