6 ms·

I agree with more or less with what you said but a downside of PHP is not security vulnerabilities, that's really just a myth. I can't remember the last vulnera

I agree with more or less with what you said but a downside of PHP is not security vulnerabilities, that's really just a myth. I can't remember the last vulnerability which could be directly attributed to PHP as a language. Sure, there are plenty of apps containing holes but those are not caused by PHP but by not coding correctly, eg not checking input making SQL injections possible etc. Which might confirm what you said, it's easy to create a huge mess with PHP. But then, it's easy to create a huge mess in any other language, too. It's probably even easier with Ruby due to its highly dynamic nature. Languages are like tools, you have to know how to use it but you can't blame the tool if somebody misuses it. Edit: Fixed typo.

pavel_lishin 17y ago
The security issues mostly come from the community; PHP is branded as a language that's easy to learn, and in that same spirit, a lot of the examples offered by the manual and by people trying to teach others are horribly insecure. I think nearly every SQL example, for instance, totally ignores the concept of SQL injection.
hapless 17y ago
Languages are like tools: buying a the best set you can afford is the best possible start to a project. PHP doesn't cause SQL injection flaws, but it doesn't make it any easier. How many escape functions are there ? Shall we count them ? ---------- mysql_escape_string() - Escapes a string for use in a mysql_query mysql_real_escape_string() - Escapes special characters in a string for use in a SQL statement mysqli_real_escape_string() - Escapes special characters in a string for use in a SQL statement, taking into account the current charset of the connection addslashes() - Quote string with slashes stripslashes() - Un-quotes a quoted string The magic_quotes_gpc directive The magic_quotes_runtime directive stripcslashes() - Un-quote string quoted with addcslashes stripslashes() - Un-quotes a quoted string addcslashes() - Quote string with slashes in a C style htmlspecialchars() - Convert special characters to HTML entities quotemeta() - Quote meta characters get_magic_quotes_gpc() - Gets the current configuration setting of magic quotes gpc ---------------- I especially love the contrast between "mysql_escape_string" and "mysql_real_escape_string," since the first one is fake in a magical, side-effect-laden way.
- EliAndrewC 17y ago
  I think this comment sums it up nicely: http://blog.ianbicking.org/php-ghetto-comment-11.html http://blog.ianbicking.org/php-ghetto-comment-11.html It basically argues that in PHP there's often an easy, insecure way to do something and a verbose, secure way to do it. With regards to SQL injection, Java is the same way; prepared statements are much more verbose and annoying than string concatenation.
  - rbanffy 17y ago
    I regard string concatenation as very annoying in Java. Actually, just about anything is annoying in Java. I guess I have been spoiled by more modern languages like... Smalltalk/80 or Lisp'56.
- brianr 17y ago
  I wouldn't be so hard on php for the mysql_* functions; they're wrappers around the C functions of the same names: http://dev.mysql.com/doc/refman/5.1/en/mysql-escape-string.html http://dev.mysql.com/doc/refman/5.1/en/mysql-escape-string.h...
  - hapless 17y ago
    I wouldn't use C for web applications, either.
- abyssknight 17y ago
  They do exist, but I would never use any of them. I'd use a prepared statement. PHP has come a long way since stripslashes. It just isn't flavor of the month.
jerf 17y ago
http://osvdb.org/search?request=PHP http://osvdb.org/search?request=PHP http://osvdb.org/search?request=Python http://osvdb.org/search?request=Python http://osvdb.org/search?request=Perl http://osvdb.org/search?request=Perl http://osvdb.org/search?request=Ruby http://osvdb.org/search?request=Ruby "One of these things, is not like the others, one of these things is not the same..." No, there's nothing "mythical" about bad PHP security. At the point where there is a two order-of-magnitude difference between PHP and Python/Perl/Ruby, I stop even really caring about the "why". PHP may be popular, but it's not that much more popular. (And even if you want to say that PHP is two orders of magnitude more popular, well, not all Python/Perl/Ruby vulns are web-related, either.)
- encoderer 17y ago
  Ok.. nice way to leave logic at the door, but it's not just that PHP is more popular. It's that it's been around longer than Python and Ruby. That list goes back a decade for PHP. Anybody using PHP seriously in a production environment is also using Suhosin and PHP is secure enough at that point to just be a consideration and not a problem.
  - jerf 17y ago
    No, as documented by others, it is that PHP has a long history of virtually begging you to put security vulnerabilities into your app, then jerking you around with crappy fixes, which interact poorly with other crappy fixes. As far as I am concerned, I can't afford to use PHP, because the community has a long, long, long history of claiming X is secure when in fact it is very, very not. ("No, really, we got it this time!") I have no reason to trust your assurances that no, no, really, really, it's all right this time, if you add this thing that I presume is not a core app and tweak it right and... no, thanks. The PHP community has no credibility left on that front, hasn't had it for years, and I've not seen some burst of skill lately that convinces me any differently.
  - chromatic 17y ago
    PHP's four years younger than Python and a year or two younger than Ruby. Age is no excuse for its security problems -- nor is the No True Scotsman fallacy sufficient to wave away its flaws.

pavel_lishin 17y ago

The security issues mostly come from the community; PHP is branded as a language that's easy to learn, and in that same spirit, a lot of the examples offered by the manual and by people trying to teach others are horribly insecure. I think nearly every SQL example, for instance, totally ignores the concept of SQL injection.

hapless 17y ago

Languages are like tools: buying a the best set you can afford is the best possible start to a project. PHP doesn't cause SQL injection flaws, but it doesn't make it any easier. How many escape functions are there ? Shall we count them ? ---------- mysql_escape_string() - Escapes a string for use in a mysql_query mysql_real_escape_string() - Escapes special characters in a string for use in a SQL statement mysqli_real_escape_string() - Escapes special characters in a string for use in a SQL statement, taking into account the current charset of the connection addslashes() - Quote string with slashes stripslashes() - Un-quotes a quoted string The magic_quotes_gpc directive The magic_quotes_runtime directive stripcslashes() - Un-quote string quoted with addcslashes stripslashes() - Un-quotes a quoted string addcslashes() - Quote string with slashes in a C style htmlspecialchars() - Convert special characters to HTML entities quotemeta() - Quote meta characters get_magic_quotes_gpc() - Gets the current configuration setting of magic quotes gpc ---------------- I especially love the contrast between "mysql_escape_string" and "mysql_real_escape_string," since the first one is fake in a magical, side-effect-laden way.

EliAndrewC 17y ago
I think this comment sums it up nicely: http://blog.ianbicking.org/php-ghetto-comment-11.html http://blog.ianbicking.org/php-ghetto-comment-11.html It basically argues that in PHP there's often an easy, insecure way to do something and a verbose, secure way to do it. With regards to SQL injection, Java is the same way; prepared statements are much more verbose and annoying than string concatenation.
- rbanffy 17y ago
  I regard string concatenation as very annoying in Java. Actually, just about anything is annoying in Java. I guess I have been spoiled by more modern languages like... Smalltalk/80 or Lisp'56.
brianr 17y ago
I wouldn't be so hard on php for the mysql_* functions; they're wrappers around the C functions of the same names: http://dev.mysql.com/doc/refman/5.1/en/mysql-escape-string.html http://dev.mysql.com/doc/refman/5.1/en/mysql-escape-string.h...
- hapless 17y ago
  I wouldn't use C for web applications, either.
abyssknight 17y ago
They do exist, but I would never use any of them. I'd use a prepared statement. PHP has come a long way since stripslashes. It just isn't flavor of the month.

jerf 17y ago

http://osvdb.org/search?request=PHP http://osvdb.org/search?request=PHP http://osvdb.org/search?request=Python http://osvdb.org/search?request=Python http://osvdb.org/search?request=Perl http://osvdb.org/search?request=Perl http://osvdb.org/search?request=Ruby http://osvdb.org/search?request=Ruby "One of these things, is not like the others, one of these things is not the same..." No, there's nothing "mythical" about bad PHP security. At the point where there is a two order-of-magnitude difference between PHP and Python/Perl/Ruby, I stop even really caring about the "why". PHP may be popular, but it's not that much more popular. (And even if you want to say that PHP is two orders of magnitude more popular, well, not all Python/Perl/Ruby vulns are web-related, either.)

encoderer 17y ago
Ok.. nice way to leave logic at the door, but it's not just that PHP is more popular. It's that it's been around longer than Python and Ruby. That list goes back a decade for PHP. Anybody using PHP seriously in a production environment is also using Suhosin and PHP is secure enough at that point to just be a consideration and not a problem.
- jerf 17y ago
  No, as documented by others, it is that PHP has a long history of virtually begging you to put security vulnerabilities into your app, then jerking you around with crappy fixes, which interact poorly with other crappy fixes. As far as I am concerned, I can't afford to use PHP, because the community has a long, long, long history of claiming X is secure when in fact it is very, very not. ("No, really, we got it this time!") I have no reason to trust your assurances that no, no, really, really, it's all right this time, if you add this thing that I presume is not a core app and tweak it right and... no, thanks. The PHP community has no credibility left on that front, hasn't had it for years, and I've not seen some burst of skill lately that convinces me any differently.
- chromatic 17y ago
  PHP's four years younger than Python and a year or two younger than Ruby. Age is no excuse for its security problems -- nor is the No True Scotsman fallacy sufficient to wave away its flaws.