Well now that some of you have met me from OSCON, you are probably thinking to yourself, “What’s the deal with your blog? There is no PHP in there, you poser.”
How true.
I better start writing some stuff, before they kick me out of the “all-star PHP line up”.1
I think that when most people hear “PHP” and “security” used in the same sentence, it seems about as out-of-place as, say, putting “Rasmus” and “Terry” in the same sentence. Basically this thread summarizes how most people view PHP security.
I suppose the first thing I need to do in order to defend the honor of PHP is say that these losers have their own agenda: foisting Java or dotNet as “real” and “enterprise”2, or perhaps they’re just sore because PHP book sales are going up at their expense.
Nothing works better than a good ad hominem, I always say.
Well I suppose for the three of you left unsatisfied with my deconstruction, I should go through the tedious task of addressing the actual complaint which boils down to:
- “PHP has the worst security history of any language.”
- “PHP shoves a mess of shit into the global namespace” (or other assorted digs on register globals).
- “PHP doesn’t have the concept of a prepared statement.”
- “PHP security cures (magic quotes, safe mode, stripslashes) are sometimes worse than the disease.”
It made all the websites yesterday that