3 ms·

It's just as secure as any other language you can write insecure code in (i.e. all of them). That may be true; I've only developed two half-serious projects in

by mfukar 16y ago

It's just as secure as any other language you can write insecure code in (i.e. all of them). That may be true; I've only developed two half-serious projects in PHP a while back. But given the amount of XSS and injection vulnerabilities we're seeing daily, I think that something is wrong with those web development guys. PHP is admittedly a widely used tool and I can't help but wonder: "Could it be just the language? Is there a possibility things would be better if PHP was abandoned?". Of course things would improve if we educated all PHP developers on the security implications of whatever it is they're programming. But so many years of coding have shown it's infeasible (for any language).

generalk 16y ago
Is there a possibility things would be better if PHP was abandoned? Nope. Beginning coders write vulnerabilities until they're otherwise educated. In PHP these are SQL injection and XSS holes. In C they're buffer overflows. Of course things would improve if we educated all PHP developers on the security implications of whatever it is they're programming. But so many years of coding have shown it's infeasible (for any language). Education is feasible for any language. Some segment of the programming population will always remain uneducated -- laziness or apathy on their part -- but this doesn't mean education doesn't work.
- mfukar 16y ago
  You mean to tell me that in a world where anyone could take up on any programming language and start writing code on one's own, properly educating that someone is feasible? Please. This isn't 1960 anymore. Code is not written by "scientists" exclusively anymore.
pilif 16y ago
up until very recently, no templating language provided XSS protection by default. Rails sample code you see in the various tutorial for example still is full of <h1><%= title %></h1> which for all versions of rails < 3 is an open door for an XSS attack. PHP had a filter extension that helps with this for ages, but it's not on by default and not widely used by the various projects which hope/need to still run on up to 10 years old versions of PHP. We'll see how the common Rails user will react to all text injected into ERB being escaped by default. I'm sure this will cause rants like http://news.ycombinator.com/item?id=1162122 http://news.ycombinator.com/item?id=1162122 which was complaining that ruby 1.9's string handling became "so complicated". "but... I just want to allow the user to type HTML and to display it - why do I have to go all these lengths to accomplish that?"

by mfukar 16y ago

generalk 16y ago

Is there a possibility things would be better if PHP was abandoned? Nope. Beginning coders write vulnerabilities until they're otherwise educated. In PHP these are SQL injection and XSS holes. In C they're buffer overflows. Of course things would improve if we educated all PHP developers on the security implications of whatever it is they're programming. But so many years of coding have shown it's infeasible (for any language). Education is feasible for any language. Some segment of the programming population will always remain uneducated -- laziness or apathy on their part -- but this doesn't mean education doesn't work.

mfukar 16y ago
You mean to tell me that in a world where anyone could take up on any programming language and start writing code on one's own, properly educating that someone is feasible? Please. This isn't 1960 anymore. Code is not written by "scientists" exclusively anymore.

pilif 16y ago

up until very recently, no templating language provided XSS protection by default. Rails sample code you see in the various tutorial for example still is full of <h1><%= title %></h1> which for all versions of rails < 3 is an open door for an XSS attack. PHP had a filter extension that helps with this for ages, but it's not on by default and not widely used by the various projects which hope/need to still run on up to 10 years old versions of PHP. We'll see how the common Rails user will react to all text injected into ERB being escaped by default. I'm sure this will cause rants like http://news.ycombinator.com/item?id=1162122 http://news.ycombinator.com/item?id=1162122 which was complaining that ruby 1.9's string handling became "so complicated". "but... I just want to allow the user to type HTML and to display it - why do I have to go all these lengths to accomplish that?"