Re:So how does hacking work anyway?
by nbpoole on Sunday May 29, 2011 @05:04PM
(#2597597)
PHP was my very first language, which in hindsight was probably a good choice for a couple reasons:
1. It's used in a ton of web applications. It's slightly less popular than in the past due to the influx of frameworks like Rails and Django, but a lot of major web software (Wordpress, Drupal, Joomla, MediaWiki, phpBB) still uses it.
2. People tend to write very insecure PHP code, especially when they fail to use a framework. Again, this is slightly less true now than it was in the past. However, it's very common to see bad practices like:
- SQL queries generated via string concatenation
- Output escaping done manually, on a per-element basis, rather than in an automatic, context-sensitive manner.
- File upload scripts that let you upload PHP files, or file download scripts that accept a filename but don't sanitize against directory traversal attacks.
1. It's used in a ton of web applications. It's slightly less popular than in the past due to the influx of frameworks like Rails and Django, but a lot of major web software (Wordpress, Drupal, Joomla, MediaWiki, phpBB) still uses it.
2. People tend to write very insecure PHP code, especially when they fail to use a framework. Again, this is slightly less true now than it was in the past. However, it's very common to see bad practices like:
- SQL queries generated via string concatenation
- Output escaping done manually, on a per-element basis, rather than in an automatic, context-sensitive manner.
- File upload scripts that let you upload PHP files, or file download scripts that accept a filename but don't sanitize against directory traversal attacks.