4 ms·

I'm surprised people aren't quicker to mention the fact that PHP was (and still is!) responsible for many simple SQL injection database dumps/hacks. A simple s

by Volscio 13y ago

I'm surprised people aren't quicker to mention the fact that PHP was (and still is!) responsible for many simple SQL injection database dumps/hacks. A simple string termination was all it took. That I felt gave PHP a massively bad rap as they spent versions after that trying to figure out a way to prevent/deter it. Nowadays with wrappers it's thankfully less of a problem. Having just come off a Drupal project myself but having looked at the latest PHP additions as well as Laravel though, it seems to me that many languages are converging and borrowing from each other, which I love. Latest PHP is pretty sweet.

mcintyre1994 13y ago
And anybody who learnt of their own accord probably had Google rapidly lead them to w3schools, and if they were really unlucky they might have noticed they have PHP tutorials. Their database query code used to use mysql_query with absolutely no protection, the basic sql injection disaster scenario. It now uses non-prepared mysqli_query, which a quick Google tells me still isn't safe. I'm sure everyone here knows it, but w3schools is seriously dangerous and seems like it will indefinitely damage the image of PHP.
krapp 13y ago
This really has been one of the cancers at the heart of PHP development. Most of the reasons people give for hating the language amount to semantic issues which make it different than the language they'd prefer it to be, or syntax which, while annoying, can be dealt with, or edge cases no one is ever likely to encounter in actual practice (although I just recently saw an example of someone's PHP where they were including php files using shell_exec so the rabbithole of 'actual practice' can get pretty deep.) The way SQL is implemented and executed still primarily is one of the primary arguments against, at the very least, not learning PHP properly. And it's definitely a point in the column of any framework in any language which can say that SQL injection and remote code execution are impossible in frameworks written in that language.
dk01 13y ago
Basically PHP is the America of programming languages.

by Volscio 13y ago

mcintyre1994 13y ago

And anybody who learnt of their own accord probably had Google rapidly lead them to w3schools, and if they were really unlucky they might have noticed they have PHP tutorials. Their database query code used to use mysql_query with absolutely no protection, the basic sql injection disaster scenario. It now uses non-prepared mysqli_query, which a quick Google tells me still isn't safe. I'm sure everyone here knows it, but w3schools is seriously dangerous and seems like it will indefinitely damage the image of PHP.

krapp 13y ago

This really has been one of the cancers at the heart of PHP development. Most of the reasons people give for hating the language amount to semantic issues which make it different than the language they'd prefer it to be, or syntax which, while annoying, can be dealt with, or edge cases no one is ever likely to encounter in actual practice (although I just recently saw an example of someone's PHP where they were including php files using shell_exec so the rabbithole of 'actual practice' can get pretty deep.) The way SQL is implemented and executed still primarily is one of the primary arguments against, at the very least, not learning PHP properly. And it's definitely a point in the column of any framework in any language which can say that SQL injection and remote code execution are impossible in frameworks written in that language.

dk01 13y ago

Basically PHP is the America of programming languages.