In the early 2000s, everyone in my bubble knew that PHP was a security nightmare, only seconded by Flash. In the meantime, Adobe gave up on Flash, but PHP is still alive and rocking.
How did that happen? Did PHP get some serious makeover? Do developers just not care?
You must log in or register to comment.
The main threat to PHP apps now are bots attempting to exploit your app to upload executables or PHP files and somehow execute them. But this is not the fault of PHP itself though, more like the app handling uploaded files in insecure manner and can happen to other apps written in other languages.
Actually, it can’t happen in other languages. It’s quite unique to PHP because it relies on a webserver to run, and that webserver will execute any file ending in .php as PHP code.
Other languages’ web engines don’t work like that. Assuming you manage to trick a Java or Node etc. into accepting a file ending in .java or .js and so on, you won’t be able to make it execute. The attempt doesn’t even make sense because those platforms don’t have a concept of allowing remote requests to indicate which file should run.
There are other backend languages that works like php in this regard such as ASP and CGI scripts (Perl, etc). Basically, if you have a bug that can be exploited to replace the app source code or binary, your backend will have similar vulnerability unless your backend uses a strict process control system (only loads source code / binary files on backend start and ignore subsequent file updates), which is the default for many backend languages these days but not all of them.
PHP makes up like 80% of all websites worldwide.
I must is missed the security concerns, I didn’t start programming in PHP until 2003.
PHP makes up like 80% of all websites worldwide.
That statistic is ridiculous and I wish people would stop quoting it because it’s not doing anybody any favors. In particular it completely discredits PHP from any chance of claiming some reasonable numbers.
The survey’s methodology is full of holes and biases and completely fails to account for all kinds of factors, such as the fact that most websites out there don’t have “powered by” headers (it’s not a thing for most of the languages they claim to have detected; and how do you detect “static files”?), or that modern cloud infrastructure is distributed and cannot be evaluated like the monolithic on-premise servers of decades ago.
If you’re still not convinced I give you two things to consider:
- Take a large site that you know for a fact is powered by PHP, like wordpress.com or any of the blogs hosted by them, and look at the HTTP headers. They don’t say anything about PHP.
- Look at the rest of the survey results. They say Ruby is more widely used than Java and Node. That Scala is more widely used than Python. That Coldfusion and Erlang are in the top ten of web server technologies. None of it makes any sense.
