5 ms·

> PHP has supported [...] safe HTML for decades, but the programmer has to understand the problem and the solution. That's not good enough for a language adver

> PHP has supported [...] safe HTML for decades, but the programmer has to understand the problem and the solution. That's not good enough for a language advertising as "Hypertext Preprocessor" though. PHP's distinguishing feature is that's kicked off from SGMLish processing instructions in otherwise static HTML, and it has all context available for perfect injection-free HTML-aware templating. Eg escaping quotes when it's outputting into attributes, escaping "]]>" when outputting into CDATA sections, or with the help of a real markup processor, suppressing/escaping <script> elements or onclick or other event handler attributes where advised through a grammar such as an SGML DTD. But it doesn't because it's just such a hack job of a language, by the developer's own admission.

DaiPlusPlus 5y ago
Further evidence of this is the fact that `<?= $foo ?>`, and the long-form `<?php echo $foo ?>`, don’t offer a way to easily HTML-encode the output; instead you have to use `htmlentities()`. Whereas ASP.NET has had `<%: foo %>` to encode output for almost 15 years now, and Razor defaults to encoding: they make it harder to render unrecoded output.
- wvenable 5y ago
  Actually only 12 years since that syntax came out with ASP.NET version 4.0. ASP.NET went a long time without it (and classic ASP before that). And, like with razor, you can use plenty of libraries with PHP that will encode by default.
  - DaiPlusPlus 5y ago
    Razor is stock though, but there is still no in-box way using PHP's own syntax to auto-encode output.
- corobo 5y ago
  Comparing a language to a framework is a bit wonky isn't it? Laravel (PHP framework) for instance has {{ $foo }}
  - DaiPlusPlus 5y ago
    PHP is simultaneously a framework and a language, though. It features a very simple framework, though, and has been supplanted by others, including those that resort to reimplementing their own templating system, which defeats the point of using PHP in the first place as that was its main goal: to be a templating system for Personal Home Pages.
  - arp242 5y ago
    PHP started life as a template engine for CGI applications written in C. And some pretty major projects like WordPress use PHP as a "template language". There are various constructs in the language rarely seen in PHP code that make this easier, such as <?=, but also also "if (..):" which can be ended with "endif", and "foreach (...):" which can be ended with "endforeach". It's not a hard feature to add. PHP devs want to move away from this "PHP as a template language" (I think they tried to remove the <?= a few years back); that's all fine, but fact of the matter is that people ARE using it as a template language and will continue to do so in the foreseeable future. Not supporting that with something as simple as "automatic escape special HTML characters" is extremely disappointing, and would actually prevent a lot of problems.
    - DaiPlusPlus 5y ago
      "I think they tried to remove the <?= a few years back)" Not quite. They deprecated `<?` but not `<?=`, see here: https://wiki.php.net/rfc/deprecate_php_short_tags https://wiki.php.net/rfc/deprecate_php_short_tags Another PHP-RFC removed `<%`, `<%=`, and `<script language="php">` (I'll admit I didn't know about that one): https://wiki.php.net/rfc/remove_alternative_php_tags https://wiki.php.net/rfc/remove_alternative_php_tags - but as with before, this specifically retained `<?=`.
      - arp242 5y ago
        Ah yes, it was just the "<?" tag and not "<?="; I misremembered. The ASP tags were always a bit of a misfeature; I don't think I've ever seen it used even once. <script language="php"> is just weird because it's intended for client-side scripts :-/
- deleted 5y ago
  [deleted]
gregjor 5y ago
I won’t disagree that PHP has its flaws. A lot of them are legacy problems to support old code. Every language and tool with a big installed base has this problem — just look at the legacy crap in Windows. It’s fairly easy to write clean and safe PHP. Any number of libraries and frameworks exist to do safe SQL queries and escape HTML. The problem is a lot of programmers don’t even know the vulnerability, not that it’s hard to fix. I could bitch and moan about PHP or make a good living fixing bad code. Complaining won’t make that legacy code better or magically rewrite it.
- tannhaeuser 5y ago
  Fair enough, but in the case of PHP, the target that XSS attacks are after are not the PHP sites themselves most of the time, but weaponizing those for c&c attacks on third-party sites. Thus merely using PHP, with its well-known combination of copy/paste culture, popularity among newbs, and poor security practices opens site owners up to liability claims (if nothing else, such as gross negligence with PII). And PHP's defense is weak, with not even an attempt to bring its built-in web templating into something that could remotely be called state of the art, considering that eg SGML is 35 years old. Not saying this to diss PHPers; in fact, I like the PHP community for their get stuff done mentality, and I think they deserve better. If I were contracting for PHP, though, I'd make sure to negotiate strong liability disclaimers.
  - gregjor 5y ago
    Are you aware of an actual case of an owner of a web site getting sued because their site was used to attack other sites, without their knowledge? This could (and has) happened with other tools besides PHP. Is Microsoft liable because Windows is used as a launchpad for attacks?
    - tannhaeuser 5y ago
      IANAL, much less a judge, but I think there's a plausible legal theory for suing isn't there?
- deleted 5y ago

DaiPlusPlus 5y ago

Further evidence of this is the fact that `<?= $foo ?>`, and the long-form `<?php echo $foo ?>`, don’t offer a way to easily HTML-encode the output; instead you have to use `htmlentities()`. Whereas ASP.NET has had `<%: foo %>` to encode output for almost 15 years now, and Razor defaults to encoding: they make it harder to render unrecoded output.

wvenable 5y ago
Actually only 12 years since that syntax came out with ASP.NET version 4.0. ASP.NET went a long time without it (and classic ASP before that). And, like with razor, you can use plenty of libraries with PHP that will encode by default.
- DaiPlusPlus 5y ago
  Razor is stock though, but there is still no in-box way using PHP's own syntax to auto-encode output.
corobo 5y ago
Comparing a language to a framework is a bit wonky isn't it? Laravel (PHP framework) for instance has {{ $foo }}
- DaiPlusPlus 5y ago
  PHP is simultaneously a framework and a language, though. It features a very simple framework, though, and has been supplanted by others, including those that resort to reimplementing their own templating system, which defeats the point of using PHP in the first place as that was its main goal: to be a templating system for Personal Home Pages.
- arp242 5y ago
  PHP started life as a template engine for CGI applications written in C. And some pretty major projects like WordPress use PHP as a "template language". There are various constructs in the language rarely seen in PHP code that make this easier, such as <?=, but also also "if (..):" which can be ended with "endif", and "foreach (...):" which can be ended with "endforeach". It's not a hard feature to add. PHP devs want to move away from this "PHP as a template language" (I think they tried to remove the <?= a few years back); that's all fine, but fact of the matter is that people ARE using it as a template language and will continue to do so in the foreseeable future. Not supporting that with something as simple as "automatic escape special HTML characters" is extremely disappointing, and would actually prevent a lot of problems.
  - DaiPlusPlus 5y ago
    "I think they tried to remove the <?= a few years back)" Not quite. They deprecated `<?` but not `<?=`, see here: https://wiki.php.net/rfc/deprecate_php_short_tags https://wiki.php.net/rfc/deprecate_php_short_tags Another PHP-RFC removed `<%`, `<%=`, and `<script language="php">` (I'll admit I didn't know about that one): https://wiki.php.net/rfc/remove_alternative_php_tags https://wiki.php.net/rfc/remove_alternative_php_tags - but as with before, this specifically retained `<?=`.
    - arp242 5y ago
      Ah yes, it was just the "<?" tag and not "<?="; I misremembered. The ASP tags were always a bit of a misfeature; I don't think I've ever seen it used even once. <script language="php"> is just weird because it's intended for client-side scripts :-/
deleted 5y ago
[deleted]

gregjor 5y ago

I won’t disagree that PHP has its flaws. A lot of them are legacy problems to support old code. Every language and tool with a big installed base has this problem — just look at the legacy crap in Windows. It’s fairly easy to write clean and safe PHP. Any number of libraries and frameworks exist to do safe SQL queries and escape HTML. The problem is a lot of programmers don’t even know the vulnerability, not that it’s hard to fix. I could bitch and moan about PHP or make a good living fixing bad code. Complaining won’t make that legacy code better or magically rewrite it.

tannhaeuser 5y ago
Fair enough, but in the case of PHP, the target that XSS attacks are after are not the PHP sites themselves most of the time, but weaponizing those for c&c attacks on third-party sites. Thus merely using PHP, with its well-known combination of copy/paste culture, popularity among newbs, and poor security practices opens site owners up to liability claims (if nothing else, such as gross negligence with PII). And PHP's defense is weak, with not even an attempt to bring its built-in web templating into something that could remotely be called state of the art, considering that eg SGML is 35 years old. Not saying this to diss PHPers; in fact, I like the PHP community for their get stuff done mentality, and I think they deserve better. If I were contracting for PHP, though, I'd make sure to negotiate strong liability disclaimers.
- gregjor 5y ago
  Are you aware of an actual case of an owner of a web site getting sued because their site was used to attack other sites, without their knowledge? This could (and has) happened with other tools besides PHP. Is Microsoft liable because Windows is used as a launchpad for attacks?
  - tannhaeuser 5y ago
    IANAL, much less a judge, but I think there's a plausible legal theory for suing isn't there?
deleted 5y ago