5 ms·
> The community is always quick to learn from > its mistakes however There was a tutorials site on the front page of HN recently. It has a few PHP tutorial
by h2s 14y ago
> The community is always quick to learn from
> its mistakes however
There was a tutorials site on the front page of HN recently. It has a few PHP tutorials.
http://codular.com/implementing-pagination http://codular.com/implementing-pagination
$sql = 'SELECT * FROM `articles` LIMIT ' . $startArticle . ', ' . $articlesPerPage;
http://codular.com/part-2-rating-system http://codular.com/part-2-rating-system
INSERT INTO `ratings`
(`rating`, `ip`)
VALUES ('{$rating}', '{$_SERVER['REMOTE_ADDR']}')
In fairness these aren't your typical "straight out of $_GET" vulnerabilities, but they impart a lax attitude towards security. For example, in the latter example above, $rating is escaped just prior to its use in that query, but $_SERVER['REMOTE_ADDR'] isn't. In the former, there is no indication whatsoever of where the variable $articlesPerPage has come from so it's impossible to tell.
The notion that some variables are "safe enough" that they don't need escaping is naive. $_SERVER['REMOTE_ADDR'] is a global variable that any other code anywhere in the script can write to. While you can't get owned immediately after putting that code live, it is still a tiny little SQL injection vulnerability waiting behind the scenes for an attacker to chain it together with some other similarly minor flaw and break in.
To this day I still come across PHP code that is vulnerable to serious, immediate SQL injection vulnerabilities and it isn't always old code. I'm not so sure that the PHP community is so quick in learning from its mistakes.
- RobAley 14y ago> To this day I still come across PHP code that is vulnerable to serious, immediate SQL injection vulnerabilities and it isn't always old code. I'm not so sure that the PHP community is so quick in learning from its mistakes. Do you not find that with other languages as well? I do.
- Daishiman 14y agoI don't know of any single, relevant Ruby or Python tutorial that does not insist on the importance of using a DB API for secure insertion of data.
- simonw 14y agoIt's a bit harsh judging the entire PHP community by the presence of yet another crap tutorial on the internet. You can bet that the people who go to PHP conferences etc (and who comprise the core PHP "community") wouldn't write example code like that.
- jeltz 14y agoAll programming languages have their share of terrible tutorials, but of all languages I have used PHP has the by far worst tutorials. The PHP core community might not write such tutorials but there are loads of people who do.
- h2s 14y agoSorry about this grumbling old man comment. I was bored and tired and I was meaning to delete it, but it has replies and stuff now so it seems a bit too sneaky. Something about HN brings out the angry jerk in me sometimes. My bad, though.
- pestaa 14y agoNo need to apologize at all. Combined with your inner grumbling old man there are still not enough hackers bashing the stupid faulty practices PHP encourages. Edit: "encourage" as in (a) not discouraging and (b) making them easier to use for novices (without understanding the consequences).
- bpatrianakos 14y agoYour comment doesn't seem "in fairness" at all. Can you tell me which language is impervious to SQL vulnerabilities? Is there some magic language out there that cleans all external input for you? Pick a language, any language, and you will just about always find that GET and POST variables aren't cleaned for you and rightly so! The language should be a tool to let you do whatever you want and leave it up to the programmer to clean input. Now, if you want to talk about frameworks that's a different story. You picked one site with one tutorial and based off that have basically proclaimed PHP to be an insecure language. For every tutorial that skips over security or has some mistake or vulnerability there are others out there that don't. The one you chose is in PHP but you can find tutorials in any language with the same flaws. We all get it by now. PHP is lame and it's cool to bash it. It has a history of being crappy. Fine, we know. But PHP in past couple of years has begun to address those flaws and has come a long way. Now that it's starting to get better people seem to want to cheer for it to fail. No matter how uncool it is it's still incredibly popular even among people here on HN. It's just that they don't like to talk about it out loud because of the stigma it now has among the language snobs. I mean, come on man. Was this really in fairness or just another cheap and easy shot. An opportunity to pile on. And to address the quote you mention... the web may still have a lot of those old and awful tutorials but that doesn't mean the community hasn't learned. More recent tutorials and information you find online is much better and the community is far more cognizant of PHPs vulnerabilities and are now using best practices far more frequently. It's always fun to bash PHP but let's just give credit where credit is due. It has taken enough steps in the right direction for it to be worthy of people taking notice. EDIT: Also, the tutorial site you linked to is actually quite good. Tutorials are tutorials, not technical manuals. So when you want to show someone how to, for example, take GET or POST input and manipulate it somehow you want to focus on that and not explain every little thing like all the ways your GET or POST array can kill you via XSS or SQL injection. You might mention in passing that you'd better clean your input but unless the article is about sanitizing and escaping inputs itself I don't see why it has an obligation to go into that much depth.
- pavel_lishin 14y ago> Can you tell me which language is impervious to SQL vulnerabilities? That's not the point. The point is that PHP tutorials/books/best practice guidelines repeatedly and consistently do this sort of thing. Even "PHP: The Good Parts" spent most of the chapter on SQL without mentioning security until the very last part, where they sort of waved their hands at it.
- jamescun 14y agoJudging the whole of PHP and its community on the basis of one very poor tutorial is very unfair to PHP and its community. There is a lot of good PHP code out there and successful applications which don't/rarely suffer these kind of exploits (at least no more so than other apps written in other languages). I'm fairly sure crap tutorials and SQL injections are possible in every language.
- tangue 14y agoPart of this problem is that a good part of the community is amateur/hobbyist, they won't learn anything. Some people in the PHP community love to think that PHP is used like Java, but for most of the amateurs it's a "cut and paste what works" workflow.
- rorrr 14y agoThese specific examples actually don't contain vulnerabilities. $startArticle is guaranteed to be an integer, for example. Blaming some badly written tutorials on the language is just trollish-lame.