Re:14 Years of SQL Injection and still the most dangerous vu...
by mikeash on Thursday August 22, 2013 @12:53PM
(#6258302)
I completely agree. However, the PHP community is still a huge part of the server-side web community, so they're largely representative even if nobody else follows their lead.
Re:14 Years of SQL Injection and still the most dangerous vu...
by astrodust on Thursday August 22, 2013 @01:23PM
(#6258505)
Representative of what? No other community follows PHP. If anything, PHP is trying to imitate other languages with varying degrees of success.
Re:14 Years of SQL Injection and still the most dangerous vu...
by mikeash on Thursday August 22, 2013 @02:22PM
(#6258965)
Representative of themselves, really. The point being that even if PHP is different from everything else, PHP is big enough that their wacky antics are still significant, and PHP alone is enough to say that escaping parameters in SQL is still widespread.
Java, Perl, Ruby, Python, C#, NodeJS and virtually other language or framework strongly encourages the use of placeholders. PHP's community stands alone in stubborn opposition to this despite having facilities to do this.
PHP is also unusually hostile to frameworks and ORM-like database layers even when these would solve a myriad of problems without imposing too greatly.
Honestly, on the whole PHP programmers in general are like hunter gatherers who see no use for anything other than the most basic of tools. There are exceptions, but I figure these people usually graduate to other communities where the best practices they follow have already been fully embraced.