4 ms·
One reason I migrated away from php is the fact that there is simply way too many attack vectors. Using frameworks help quite a bit, but it is to easy to miss c
by bhhaskin 13y ago
One reason I migrated away from php is the fact that there is simply way too many attack vectors. Using frameworks help quite a bit, but it is to easy to miss configure a stock php install. Not saying that is the case here though.
- thejosh 13y agocurious what you are using now?
- bhhaskin 13y agoCurrently using Django. Once I started playing around with it I haven't looked back. Although I am told cake php and a few other frameworks really do improve php.
- hwh 13y agoI'm tempted to say: they improve programmers.
- camus2 13y agothey dont improve PHP. you still have to deal with PHP shortcomings even with a framework. But since you dont deal with low level stuffs your code might be more secure yeah. PHP has too many unsecure apis accessible to beginners. With Django for instance you have a view layer with auto escaping by default.You dont write unsecure SQL queries ,..., That makes a huge difference.
- topac 13y agowe have no proofs that is related with the fact that the domain has been blacklisted by google
- bhhaskin 13y agoYou are correct. Like I said, I doubt that is the case. Php can be very secure if configured correctly.
- camus2 13y agothat's the issue, PHP should be secure(ie restrictive) by default, Linux style... it is not. PHP+Apache => recipe for disaster. PHP is a templating language yet doesnt do html sanitizing by default ! 95% of compromised websites are PHP ones. That's the reason why PHP will die eventually,when businesses understand while it's cheap to go online with a PHP cms, once you get hacked , it will cost you your business.
- acqq 13y agoIt's "tagged" by Google. When I search php from the iPhone I get: "PHP: Hypertext Preprocessor php.net/ This site may harm your computer. Server-side HTML embedded scripting language. It provides web developers with a full suite of tools for ..." Google inserts the "harm" note.
- bhhaskin 13y agoYes, but there are quite a few ways to get flagged by Google.
- dancecodes 13y agowhen many attacks are occurs it is going more interesting...
- dancecodes 13y agoand you now using sql-prepare-query instructions after escape from php?
- bhhaskin 13y agoUsing Django ORM. if you haven't used an ORM before you are missing out.
- dancecodes 13y agoUsing prepared statements is necessary condition (of secure) for any application independent of language. Almost all databases (and their drivers) support prepared statements.
- krapp 13y ago... you know PHP's supported PDO for a while now, right?
- dancecodes 13y agoeach db driver support it
- dkloke 13y agoyou do realize that this is a javascript exploit? just sayin.
- ubersoldat2k7 13y agoYou'd have to be pretty stupid to think this is exploting some sort of PHP bug. OMG! Did I just defend PHP? Gotta go take my medication.
- camus2 13y agoand how did the js exploit end up on their servers? through php code likely.
- eksith 13y agoThat's speculation. I've seen servers get compromised due to FTP problems, SSH misconfiguration, unpatched Apache vulnerabilities, third-party stats monitoring software with 0-days and even SQL injection. Defacement (I consider malware injection a form of defacement) isn't unique to PHP by a long shot.
- wyck 13y agoThis is ridiculous speculation on your part, you can't speculate with security, for all you know the webmaster's ex-girlfriend could have inserted the malware.
- bhhaskin 13y agoYes. It was more of a general statement.