Re:PHP 7 Virtual Machine
by marcosdumay on Monday April 17, 2017 @11:29AM
(#14131618)
You would have a point the frameworks you provided had that kind of protection by default (or if you could at least enable it project-wide), and if PHP development were mostly done on them, instead of wordpress and drupal.
Besides, there's more to security than SQL injections and XSS. The PHP tooling is overflowing with bad practices.
Re:PHP 7 Virtual Machine
by tpetry on Tuesday April 18, 2017 @03:59AM
(#14137141)
Take a look again. Each of those Frameworks is using a template engine which is escaping any ouput by default.
If you do not need escaping, you have to opt-out for single outputs.
Besides, there's more to security than SQL injections and XSS. The PHP tooling is overflowing with bad practices.