3 ms·
I'm not going to throw stones either. But I would encourage developers to make their sample code robust. Especially as > many PHP users are hobbyists or come f
by ChrisSD 8y ago
I'm not going to throw stones either. But I would encourage developers to make their sample code robust. Especially as
> many PHP users are hobbyists or come from a more traditional "webmaster" background
I seem to remember a somewhat related problem with WordPress. The issue there was made worse by the fact the sample code was part of the default install and so available to anyone who knew the URL.
Edit: A quick search shows I was thinking of an XSS attack. It was due to some bad example code in the default theme folder, which is by default publicly accessible even if not used.
https://arstechnica.com/information-technology/2015/05/actively-exploited-wordpress-bug-puts-millions-of-sites-at-risk/ https://arstechnica.com/information-technology/2015/05/activ...
- blueimp 8y agoI agree, the sample code should have been secure by default (with all web server configurations) because it's guaranteed that someone will use it as is without checking their own server configuration. And inexperienced webmasters were definitely part of the target group, since I wanted to make is as accessible as possible, including for those users on shared hosting webspace without access to the Apache configuration files.
- londons_explore 8y agoThe simplicity of the sample code is a strong factor in deciding what library to use for a task. If the 'hello world' example is hundreds of lines, then I imagine the effort of using this library to be a few days at least. If the 'hello world' example is just 3 lines, then I can probably integrate this library into my service in 10 minutes. Making the sample code more robust (handling errors, checking for legacy configs, etc.), makes it longer, which in turn puts off people like me.