4 ms·
JavaScript land fares little better. IMO it’s because php and js are so easy to pick up for new programmers. They are very forgiving, and that leads to… well…
by dartos 2y ago
JavaScript land fares little better.
IMO it’s because php and js are so easy to pick up for new programmers.
They are very forgiving, and that leads to… well… the way that php and js is…
- awesomeMilou 2y agoI'm sorry, I haven't encountered bare eval in years. Do you have an example? And even then it's actually not that easy to get RCE going with that.
- donatj 2y agoSomething like half of of reported JavaScript vulnerabilities are "prototype pollution" because It's very common practice to write to object keys blindly, using objects as a dictionary, without considering the implications. It's a very similar exploit.
- baq 2y agoarguably worse, since no eval is needed...
- johnisgood 2y agoYeah, same with the use of "filter_input_array", "htmlspecialchars", or how you should use PDO and prepare your statements with parameterized queries to prevent SQL injection, etc.
- btown 2y agoThe saving grace of JS is that the ecosystem had a reset when React came out; there's plenty of horrifying JQuery code littering the StackOverflow (and Experts Exchange!) landscape, but by the time React came around, Backbone and other projects had already started to shift the ecosystem away from "you're writing a script" to "you're writing an application," so someone searching "how do I do X react" was already a huge step up in best practices for new learners. I don't think PHP and its largest frameworks ever had a similar singular branding reset.
- snerbles 2y agoLaravel, maybe. But not as much as React, or the other myriad JS frontend frameworks. (to include the ones that appeared in the time I spent typing this post)
- sjm-lbm 2y agoI'd argue that PHP7 is the closest thing PHP has had to a quality revolution. It fixed a zillion things, got rid of some footguns like legacy mysql, and in general behaved a lot more rationally. If you were doing things right, by that point you were already using Laravel or Symphony or something, so the change didn't seem as revolutionary as it was, but that was the moment a lot of dumb string concatenated query code (for example) no longer worked out of the box.
- MajimasEyepatch 2y agoThe other thing making JavaScript a little better in practice is that it very rarely was used on the back end until Node.js came along, and by then, we were fully in the AJAX world, where people were making AJAX requests using JavaScript in the browser to APIs on the back end. You were almost never directly querying a database with JavaScript, whereas SQL injection seems to be one of the most common issues with a lot of older PHP code written by inexperienced devs. Obviously SQL injection can and does happen in any language, but in WordPress-land, when your website designer who happens to be the owner's nephew writes garbage, they can cause a lot of damage. You probably would not give that person access to a Java back end.
- numb7rs 2y agoI've heard it said that one of the reasons Fortran has a reputation for bad code is this combination: lots of people who haven't had any education in best practices; and it's really easy in Fortran to write bad code.
- hinkley 2y agoWhich is why that “you can write Fortran in any language” is such an epithet.
- tracker1 2y agoMost horrific code I've ever seen was a VB6 project written by a mainframe programmer... I didn't even know VB6 could do some of the things he did... and wish I never did. Not to mention variables like a, b, c, d .. aa, ab...
- MajimasEyepatch 2y agoCode written by scientists is a sight to behold.
- craigmoliver 2y agoand they think cause they're scientists they can just do it because they're scientists and stuff. Very pragmatic to be sure...but horrifying.
- hinkley 2y agoAt least the node community is mostly allergic to using eval(). The main use I know of goes away with workers.