2 ms·

I'm sure it's possible to write secure PHP code but PHP actively works against you. The language has improved a bit over the years (magic quotes is no longer a

I'm sure it's possible to write secure PHP code but PHP actively works against you. The language has improved a bit over the years (magic quotes is no longer a thing) but I don't have any confidence that the PHP developers will make reasonable choices in the future. Take something like == to compare two strings. A reasonable person would compare them as strings. A PHP developer would try to compare them as numbers (losing information in the process). Many PHP users don't consider that a problem. Many PHP developers don't consider that a problem. (Some realize it's stupid but don't want to break backwards compatibility).

sarciszewski 12y ago
I typically use === or hash_equals() depending on the use case ;) Magic quotes needed to die. There are also a lot of other improvements in the past few years that I've grown to appreciate. MD5/SHA1 password hashing need(ed/s) to die; password_hash() and password_verify() needed to become a thing. Register globals needed to die. There are still some changes that I believe are necessary to clean up the rest of the ecosystem. MCRYPT_RAND needs to die. Devs choosing MCRYPT_RIJNDAEL_256 thinking it's AES with a 256 bit key rather than a non-AES flavor of Rijndael still needs to die. Composer's unverified curl | php needs to die.