Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Arno Welzel Newsgroups: comp.lang.php Subject: Re: PHP boilerplate to appear at the top of any program Date: Wed, 30 Dec 2015 11:26:09 +0100 Lines: 44 Message-ID: <5683B141.5080909@arnowelzel.de> References: <2838299.zdqeYZrqYU@PointedEars.de> <1473248.ziGLShfuNh@PointedEars.de> <5131195.4d26jNU0Ms@PointedEars.de> <1535700.EMr0ZOzjxF@PointedEars.de> <6olgy.31399$b8.17906@fx29.iad> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Trace: individual.net hFl9nvdbNRO3LRR5Ds1G8wUJrPC+JnnNcN91AK9o3gA/nB5lxf Cancel-Lock: sha1:ZLTW5mMiZX7F6lO3D3JtQBvU/UI= In-Reply-To: Xref: csiph.com comp.lang.php:16009 Jerry Stuckle schrieb am 2015-12-29 um 02:48: > On 12/28/2015 8:31 PM, Richard Damon wrote: [...] >> Have made extensive use of Joomla and Drupal, I can say that having code >> IN the database is the exception, not the rule. 99% of your code is in >> normal php files in the modules used to build the site. They allow, but >> discourage the ability to place snippets in the database to allow >> building more complicated conditions/'rules' for behavior, but this >> comes with major warnings that if you allow this to be done, you have >> opened a major security hole in your site. >> > > I also have had to pick up maintenance of Drupal, Joomla and WordPress > sites other programmers have screwed up. I am *quite* familiar with the > structure. > > Yes, most of the code is in modules and other files WRITTEN BY OTHER > PEOPLE. But the majority of code YOU WRITE goes in the database. Very No - it doesn't. Don't mix up crap written by third parties with the core or Drupal, Joomla or WordPress. How many websites did you set up from scratch in Drupal, Joomla, WordPress? How many add-ons, themes, extensions, modules etc. did you develop for Drupal, Joomla and WordPress? > few people are going to learn how to write a module just to put in a few > filters or display something from another database. Rather, they'll put > it right in the page - which places it in the database. > > Sure, it's a potential security hole. But only if you don't know what > you're doing. Unfortunately, few programmers who use a CMS or > frameworks know how to secure a website properly. So what? This is not the problem of the CMS as it is not the problem of PHP itself that people without enough knowledge write bad code. -- Arno Welzel http://arnowelzel.de http://de-rec-fahrrad.de http://fahrradzukunft.de