Ask HN: Why do people believe “PHP developer” means security ignorance?

Re:Ask HN: Why do people believe “PHP developer” means secur... by ksherlock on Monday November 17, 2014 @09:53AM (#8618391)

I'm sure it's possible to write secure PHP code but PHP actively works against you. The language has improved a bit over the years (magic quotes is no longer a thing) but I don't have any confidence that the PHP developers will make reasonable choices in the future.

Take something like == to compare two strings. A reasonable person would compare them as strings. A PHP developer would try to compare them as numbers (losing information in the process). Many PHP users don't consider that a problem. Many PHP developers don't consider that a problem. (Some realize it's stupid but don't want to break backwards compatibility).

[ Parent | on HN ]

Re:Ask HN: Why do people believe “PHP developer” means secur... by sarciszewski on Monday November 17, 2014 @10:09AM (#8618474)

I typically use === or hash_equals() depending on the use case ;)

Magic quotes needed to die.

There are also a lot of other improvements in the past few years that I've grown to appreciate.

MD5/SHA1 password hashing need(ed/s) to die; password_hash() and password_verify() needed to become a thing.

There are still some changes that I believe are necessary to clean up the rest of the ecosystem.

MCRYPT_RAND needs to die.

Devs choosing MCRYPT_RIJNDAEL_256 thinking it's AES with a 256 bit key rather than a non-AES flavor of Rijndael still needs to die.

Composer's unverified curl | php needs to die.

[ Parent | on HN ]