4 ms·
Did Perl or C protect you against this when PHP came out?
by disgruntledphd2 6y ago
Did Perl or C protect you against this when PHP came out?
- bawolff 6y agoWell register_globals was a kind of uniquely php thing, but that's been gone for ages at this point. I generally agree though that lots of the hate for php is a bit over the top.
- megous 6y agoAuto-escaping every GET/POST input at input time was quite something. Also arrays being pass by value is a lot of fun to this day: $a = [1]; $b = $a; $b[] = 3; var_export($a); And that you could pass by ref at call time to any function. That was also quite unique.
- Zak 6y agoCGI didn't have register_globals, so yes on that count. I'm sure the quality of database access libraries varied, which is still a better situation than having a broken escape function built in to the language.
- wbl 6y agoYes. Perl has had taint mode since 1994, and for setuid scripts for longer.
- MichaelBurge 6y agoFor SQL: On CPAN, the oldest release in 1995 of DBI does seem to support bind params. https://metacpan.org/source/TIMB/DBI-0.64/DBI.pm https://metacpan.org/source/TIMB/DBI-0.64/DBI.pm
- disgruntledphd2 6y agoThank you! I honestly didn't know (not paying attention to web programming back then) and was wondering if PHP's craziness was standard back then.