News for hackers. Stuff that matters.

A comment on PHP Sucks But I Like It. Parent comment

Re:PHP Sucks But I Like It by maratd on Tuesday April 10, 2012 @10:42PM (#3825666)
> However, for building applications that might get deployed somewhere, or talk to a database in a secure fashion, it's a nightmare.

In what decade? Ever heard of PDO? Prepared statements? PHP is actually more secure when it comes to database connections than all of the wonderful alternatives you mentioned.

[ Parent | on HN ]
Re:PHP Sucks But I Like It by fuzzix on Wednesday April 11, 2012 @04:42AM (#3826548)
"Prepared statements? PHP is actually more secure..."

The most commonly used module for mysql access, mysql (not mysqli for some reason), does not support bound parameter prepared statements instead opting for some very funky string escaping business.

Prepared statements are generally the only supported SQL mechanism in other languages/platforms I have used (C, Perl, Ruby, Java, COBOL...)

[ Parent | on HN ]
Re:PHP Sucks But I Like It by briandear on Tuesday April 10, 2012 @11:31PM (#3825783)
More secure? Then I suppose I'll get all of the insurance and banking portals to rewrite everything in PHP -- since is so secure and easy to use.
[ Parent | on HN ]
Re:PHP Sucks But I Like It by maratd on Tuesday April 10, 2012 @11:48PM (#3825827)
> Then I suppose I'll get all of the insurance and banking portals to rewrite everything in PHP

From COBOL? Probably a good idea.

[ Parent | on HN ]