4 ms·
> Probably contrary to common belief here I don't think that is true. PHP just makes it easy to write anything - including insecure code. And the bigger issue
by cleverjake 13y ago
> Probably contrary to common belief here
I don't think that is true. PHP just makes it easy to write anything - including insecure code. And the bigger issue is that the community around PHP often shares code that is insecure without knowing that it is, or why that would be important.
The C argument is a red herring - its not meant for web pages. (web servers, though...)
Rails is not a language. It is a framework. Wordpress has tons of vulns as well.
I agree that "Everything can be a turd in the wrong hands", however, one of the biggest parts of, er, "turd prevention" is the culture and tribal knowledge around a language and best practices. PHP struggles with that because it is so easy to learn and so easy to do something bad.
- einhverfr 13y agoI think one issue is that there are a number of somewhat dangerous foot-guns security-wise in extension-land. For example, last I checked the pgsql extension had implicit, global, anonymous database connections. Culture is part of it, but part of the culture is figuring out how to ensure that programmers can verify security. Yes, anyone can write insecure code in any language, but can anyone write provably reasonably secure code in a given language? That's a far harder question. I don't see PHP scoring very well in that regard.
- draginator 13y agoPHP makes it easy to do easy things terribly, but makes it extremely difficult to do normal things well.