Sure, there are plenty of apps containing holes but those are not caused by PHP but by not coding correctly, eg not checking input making SQL injections possible etc.

Which might confirm what you said, it's easy to create a huge mess with PHP.

But then, it's easy to create a huge mess in any other language, too. It's probably even easier with Ruby due to its highly dynamic nature.

Languages are like tools, you have to know how to use it but you can't blame the tool if somebody misuses it.

Edit: Fixed typo.

----------

mysql_escape_string() - Escapes a string for use in a mysql_query

mysql_real_escape_string() - Escapes special characters in a string for use in a SQL statement

mysqli_real_escape_string() - Escapes special characters in a string for use in a SQL statement, taking into account the current charset of the connection

addslashes() - Quote string with slashes

stripslashes() - Un-quotes a quoted string

The magic_quotes_gpc directive

The magic_quotes_runtime directive

stripcslashes() - Un-quote string quoted with addcslashes

stripslashes() - Un-quotes a quoted string

addcslashes() - Quote string with slashes in a C style

htmlspecialchars() - Convert special characters to HTML entities

quotemeta() - Quote meta characters

get_magic_quotes_gpc() - Gets the current configuration setting of magic quotes gpc

----------------

I especially love the contrast between "mysql_escape_string" and "mysql_real_escape_string," since the first one is fake in a magical, side-effect-laden way.

It basically argues that in PHP there's often an easy, insecure way to do something and a verbose, secure way to do it. With regards to SQL injection, Java is the same way; prepared statements are much more verbose and annoying than string concatenation.

Actually, just about anything is annoying in Java. I guess I have been spoiled by more modern languages like... Smalltalk/80 or Lisp'56.

http://dev.mysql.com/doc/refman/5.1/en/mysql-escape-string.h...

http://osvdb.org/search?request=Python

http://osvdb.org/search?request=Perl

http://osvdb.org/search?request=Ruby

"One of these things, is not like the others, one of these things is not the same..."

No, there's nothing "mythical" about bad PHP security. At the point where there is a two order-of-magnitude difference between PHP and Python/Perl/Ruby, I stop even really caring about the "why". PHP may be popular, but it's not that much more popular. (And even if you want to say that PHP is two orders of magnitude more popular, well, not all Python/Perl/Ruby vulns are web-related, either.)

I like this quote about PHP: "HP is just this piece of shit that you just put together—put all the parts together—and you throw it against the wall and it fucking sticks." (Terry Chay)

Anybody using PHP seriously in a production environment is also using Suhosin and PHP is secure enough at that point to just be a consideration and not a problem.

I think nearly every SQL example, for instance, totally ignores the concept of SQL injection.

I love Rails but the fanboy culture really sucks.

Actually, perhaps unintentionally, you still hit the nail on the head.

Dane Cook is a comedian who hit it BIG, in part, due to MySpace. He's been in a couple of movies, including "Employee of the Month."

He's got millions of fans, but also a sizeable group of haters, inlcuding many of his fellow comedians. He's just another in a series of people or items that hit it big, leaving many of us wondering why.

That's why I am unsure about Zed Shaw at EuroDjangoCon. I love to have smart and capable people around, but Zed still has to prove he can play well with others.

What does that mean? I'll take the compliment, but I'm not sure what the difficulty is in making PHP 'behave correctly.'