How come PHP seems so much faster than Rust?

Re:How come PHP seems so much faster than Rust? by delfinom on Saturday September 28, 2019 @08:55PM (#21104215)

But plenty of those vulnerabilities are not the fault of the language but the frameworks written by others. You can just as easily create SQL injection attacks in a Rust program or Ruby program. You can just as easily introduce XSS/CSRF problems in any of them. Etc.

[ Parent | on HN ]

Re:How come PHP seems so much faster than Rust? by Avamander on Saturday September 28, 2019 @10:19PM (#21104590)

If the majority of frameworks for a language are vunerable it's the language's fault. Python definitely doesn't have that issue, Rust and Go don't either.

[ Parent | on HN ]

Re:How come PHP seems so much faster than Rust? by francislavoie on Saturday September 28, 2019 @11:57PM (#21104968)

> majority of frameworks for a language are vunerable

Where's your proof? Modern PHP frameworks are secure by default.

[ Parent | on HN ]

Re:How come PHP seems so much faster than Rust? by Avamander on Sunday September 29, 2019 @09:25AM (#21106902)

We're talking about the majority of frameworks that are being used, not about some newer versions 0.1% use. In the end arguing won't get neither of us anywhere, I get my livelihood from testing vulnerable software and you can keep writing software in PHP.

[ Parent | on HN ]

Re:How come PHP seems so much faster than Rust? by jtreminio on Sunday September 29, 2019 @01:28PM (#21108325)

Majority of frameworks in use are:

Symfony Laravel CodeIgniter CakePHP Yii Zend Slim

All of these can (and recommend) using either PDO with named parameters, or a full ORM for SQL work. Most came packaged with a PDO (Doctrine, mostly) by default but have always supported whatever you wanted to use.

Write shit code, win shit prizes.

[ Parent | on HN ]

Re:How come PHP seems so much faster than Rust? by beatgammit on Saturday September 28, 2019 @09:16PM (#21104325)

> You can just a easily create SQL injection attacks in a Rust program

I disagree, mostly on the grounds that string concatenation isn't very convenient, so it tends to be easier to do things "the right way" instead of hacking things together. Yes, you can do string concatenation using something like `format!(...)`, but at that point it's really similar to the correct solution that it's not really what you'd reach for by default.

And yeah, the community here is a huge part of it, and IMO languages can and should be judged by their communities. If a language's community promotes insecure solutions, that's a language that I don't want to use at my company because I don't want my employees following that example.

[ Parent | on HN ]