5 ms·

It's not awesome if the applications so developed by amateurs grows to store PII, financial information or do anything that has any security consequences whatso

• patio11 15y ago
  Most applications developed by professionals in Big Freaking Enterprise Languages working in regulated industries will also have game over security vulnerabilities. Most applications developed by the cool kids in Ruby/Python working for startups will have game over security vulnerabilities. The current state of information security: basically, we're screwed.
  • daeken 15y ago
    Agreed. While PHP apps are definitely more likely than others to be vulnerable to systemic SQL injection, XSS, and other vuln classes of that sort, all applications are equally vulnerable to things like command injection, authorization bugs, etc. No one gets that stuff right, and if you can execute code on the system, well, it doesn't really matter if you can't find SQLi.
    • corford 15y ago
      Why is PHP more likely than others to be vulnerable to SQL injection attacks? Most people (and likely All newbies) will be using PDO which automatically protects them.
      • alttag 15y ago
        It's only a protection if properly used. Bound parameters don't work well for some types of dynamic queries.
        • corford 15y ago
          How do other dynamic languages (e.g. Ruby, Python) deal with this? Also, if you've reached the point where PDO is too restrictive for what you want to do, you should be knowledgeable enough to write your own db class that incorporates sql injection protection (since all that largely consists of is escaping strings).
      • losvedir 15y ago
        This is why: http://www.google.com/search?q=php+mysql http://www.google.com/search?q=php+mysql Searching for PHP and MySQL yields tons of tutorials, code examples, and documentation related to the now-deprecated mysql interface. When I wrote my first comprehensive PHP application last year I spent half a day trying to determine best practices before finally settling on PDO. Newbies won't go through that effort, and will naively land on mysql rather than PDO or mysqli as likely as not.
        • ericingram 15y ago
          There's a lot of tutorials, and that makes PHP bad? Sure the tutorials don't teach what you prefer. This just seems like a silly argument.
          • nbpoole 15y ago
            It's not a matter of preference: it's a matter of secure or insecure. The mysql extension for PHP doesn't support prepared statements and as such is inherently less secure than any other mechanism for working with MySQL (The mysqli extension and PDO being the two alternatives for PHP). But losvedir's point is that the number of tutorials that use the mysql extension's API far outweighs the number of tutorials that use PDO or mysqli, and that those tutorials are often very poor quality (ie: contain SQLI).
        • corford 15y ago
          Actually, I agree with you and I think this is often missed as one of the main contributing factors to PHPs bad rep. If I had enough spare time (and a wider personal network of php pros to draw from) I'd love to make something like www.betterphp.org with short tutorials and guides teaching newbies the current best practices. As it is, anyone picking up PHP for the first time is confronted with a minefield of conflicting and out of date information, some of which is dangerous. PHP has been around forever and Google has a long memory. Unfortunately, for every good blog post/tutorial on PHP development there are 100 or more bad or out of date ones.
  • anthonyb 15y ago
    PHP sites will have a hell of a lot more of them, though. You're not shielded against CSRF, XSS or SQL injection attacks unless you use a framework - at which point you're back to being a programmer with no "empowered amateur" in sight...
    • djmdjm 15y ago
      Hell, for most of then you aren't even protected against remote code execution. Google for "PHP arbitrary script execution" and weep.