News for hackers. Stuff that matters.

A comment on Stack Overflow: Defend PHP - convince me it isn't horrible. Parent comment

Re:Stack Overflow: Defend PHP - convince me it isn't horrible by Daishiman on Wednesday July 14, 2010 @11:21AM (#1514825)
What do you mean?? Do you have any idea of just how many programmer hours have been wasted by the absence of features, just how insecure so many web apps are due to the weird casting system and lack of safety-oriented features.

My impression is that people who claim PHP has not cost them development time have simply never looked at alternatives that solve many of the problems.

[ Parent | on HN ]
Re:Stack Overflow: Defend PHP - convince me it isn't horrible by hackermom on Wednesday July 14, 2010 @11:26AM (#1514847)
Without going off on a limb, I'm guessing you're a not too experienced developer. You comment as if instead going for Perl, Ruby or ASP inherently makes an application safe, saves buttloads of manhours etc. And you're wrong. Gravely wrong.

Excluding the obvious issues caused by bugs that are a natural part of any programming language's development, security problems are not caused by the language chosen, but by the developers themselves.

[ Parent | on HN ]
Re:Stack Overflow: Defend PHP - convince me it isn't horrible by Daishiman on Wednesday July 14, 2010 @03:27PM (#1515660)
Really? So the fact that you are unknowingly casting integers to strings and vice-versa does not lead to security vulnerabilities is just fiction? Being able to escape characters? Making prepared statements and having sane exception management?

If your statement were true, then by that measure making a program in assembly would be as safe as doing it in C#. Evidently, it is not. Languages make certain idioms easier or worse, and they have a culture of security or they do not, which is reflected in development methodologies, libraries, and code samples.

PHP fails massively in all those regards.

[ Parent | on HN ]
Re:Stack Overflow: Defend PHP - convince me it isn't horrible by chromatic on Wednesday July 14, 2010 @12:23PM (#1515062)
A well designed language or library can decrease the likelihood of specific bugs, and especially security problems. Imagine the existence of a library which made it easier to use SQL placeholders than to concatenate user input into a string. Imagine PHP without register globals.
[ Parent | on HN ]
Re:Stack Overflow: Defend PHP - convince me it isn't horrible by hackermom on Wednesday July 14, 2010 @02:51PM (#1515558)
PHP already does that via PDO. PHP's "Register globals" was deprecated exactly one year ago, in 5.3.0.
[ Parent | on HN ]
Re:Stack Overflow: Defend PHP - convince me it isn't horrible by moell on Thursday July 15, 2010 @08:39AM (#1517596)
That was exactly chromatic's point---language design and features do make a difference.
[ Parent | on HN ]
Re:Stack Overflow: Defend PHP - convince me it isn't horrible by hackermom on Thursday July 15, 2010 @10:02AM (#1517803)
It's always easier to blame the tool for your failed craft than it is to be a good programmer, isn't it :)

Putting PHP in the "inadequate corner" or trying to convince oneself that it is lacking in features is just an easy excuse.

[ Parent | on HN ]
Re:Stack Overflow: Defend PHP - convince me it isn't horrible by chromatic on Friday July 16, 2010 @01:58PM (#1521900)
It's always easier to blame the tool for your failed craft than it is to be a good programmer, isn't it :)

Do you object to the attractive nuisance doctrine?

[ Parent | on HN ]