Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail From: Jerry Stuckle Newsgroups: alt.os.linux,alt.os.linux.ubuntu,comp.lang.php Subject: Re: query: how many use PHP for linux scripts Date: Thu, 15 May 2014 08:08:33 -0400 Organization: A noiseless patient Spider Lines: 32 Message-ID: References: <49ef9$53723273$4b5a0f02$24917@ALLTEL.NET> <130520142135202128%timstreater@greenbee.net> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Injection-Date: Thu, 15 May 2014 12:08:32 +0000 (UTC) Injection-Info: mx05.eternal-september.org; posting-host="3088393e34bc61b3e6a923d0c81ae1e3"; logging-data="24828"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18l0Nz026y4/rAOvSfI16pCmxRN+mGEHLg=" User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0 In-Reply-To: Cancel-Lock: sha1:8qBH81qTlRL010SQIU74Ggiq4NU= Xref: csiph.com comp.lang.php:13712 On 5/15/2014 4:07 AM, crankypuss wrote: > On 05/14/2014 01:54 PM, JEDIDIAH wrote: >> On the other hand, PHP has gained itself a reputation for being >> the modern day equivalent of Sendmail or BIND in terms of being a >> security disaster. > > I think that's mostly because of builtin session support and its > tendency to be used for mySQL queries that occur clear-text in the url. I have to disagree here. Languages are neither secure nor insecure. Programs are, though. I think it's more because there are too many people like TNP who call themselves "programmers" but have no business being near a computer. PHP is a relatively easy language to learn, but like any language, you have to know what you're doing to write secure code. Too many people stop learning before they get to that point. That's a great part of what quality control and testing is about - not only feeding the code good input to ensure it responds correctly, but also feeding it bad input to ensure the code rejects it properly. But way too many people only check responses to "good" data, and don't ensure "bad" data is properly rejected. The result is things like SQL injection and other security issues. -- ================== Remove the "x" from my email address Jerry Stuckle jstucklex@attglobal.net ==================