3 ms·
It's insecure by the language design, not from the framework itself. When I pen test PHP custom-built sites, I almost always find a dozen high-severity securit
by guidedlight 13y ago
It's insecure by the language design, not from the framework itself.
When I pen test PHP custom-built sites, I almost always find a dozen high-severity security defects.
Many of the popular PHP-MySql tutorials on the web have sql injection bugs, not a good way to learn a new language.
- krapp 13y agoAlthough, any decent framework should take care of most of those issues. It wouldn't for instance, be using the mysql functions at all, or something like md5 for hashing passwords, or not escaping user data by default (three common issues I can think of off the top of my head..) Not saying PHP is secure by any means, but it can be implemented securely - it just isn't very often. That said, if there is an argument to be made for PHP, i'm afraid to say, I don't think the linked article does a good job of making it. While I think its suggestion that PHP has evolved beyond some of the common criticisms against it might have merit, it doesn't address that the bulk of PHP code in the wild most definitely has not.
- someguy1233 13y agoIt's definitely unfortunate that PHP code in various websites across the web is designed horridly, it's also sad that we're unable to fix most things in PHP e.g. the needle-haystack problem, without destroying compatibility. HHVM has done a decent job at cleaning it up with Hacklang, but some of these legacy issues we're going to be dealing with for a long time. PHP is evolving, many sites on the web are too. But legacy codebases are here to stay, I mean look at how many sites are still on classic ASP. PHP was one of my first programming languages so I will defend it, the ecosystem is much cleaner than it was a few years ago, and it's still the easiest to deploy language IMO.