Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:58468
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.54 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <A633CF2D7C7BED41B41F1E64F25507B8069DC46E57@MAILR001.mail.lan>
References: <CAG=uTXEfTBqX7n0_zfGjB_txQFKtZXF4MOo6RHHPSRPerGeKZA@mail.gmail.com>
	<CAKOpQSyxDDqiaXQbVZHE-5K_hOS8dOx4g6Bsj+yJ9BjmTOMh8Q@mail.gmail.com>
	<693e15008681dfe7372eaea66214f8a8.squirrel@www.l-i-e.com>
	<CAKOpQSxh78xMqm=aQ1jBx1T4VJ-BfKHQkxha4B=mHe6TAeiQGw@mail.gmail.com>
	<A633CF2D7C7BED41B41F1E64F25507B8069DC46CEF@MAILR001.mail.lan>
	<CAKOpQSyyXfuCmcx63EgoQa-pkUxT+STS=TNOJvTQ1JEwG=VKow@mail.gmail.com>
	<4F4D5D44.5090307@developersdesk.com>
	<CAGovj_MuUqMaVb_dPTNvTPkD3BcNPGkx88i5uQbbVe=j+dGA8Q@mail.gmail.com>
	<CAKOpQSx0mgixv3DA8FS0hL5QNb-8p5v6u=jYQ5d7HRuAVr6P1Q@mail.gmail.com>
	<de418e115ec35d6471a9143753be164a.squirrel@www.l-i-e.com>
	<CAKOpQSx56j=TFnbcbxJvW5-jPBAHyBXs=RK87rN9pU+gXssNfg@mail.gmail.com>
	<A633CF2D7C7BED41B41F1E64F25507B8069DC46DC0@MAILR001.mail.lan>
	<f7238224c6b990a4930011352aa897c3.squirrel@www.l-i-e.com>
	<CAKOpQSxATsTfetZa87WaeTN8BjOCDXYOhJ8Tcr2eGW5NJ7+TYg@mail.gmail.com>
	<A633CF2D7C7BED41B41F1E64F25507B8069DC46DC5@MAILR001.mail.lan>
	<c5e881836e676df9f75afff4a14536de.squirrel@www.l-i-e.com>
	<A633CF2D7C7BED41B41F1E64F25507B8069DC46E57@MAILR001.mail.lan>
Date: Fri, 2 Mar 2012 03:13:41 -0800
Message-ID: <CAFWS2+Gfx+dRnXOn=0xZ_NybHXTLnp3iXF-VkVfP16meEpBsOQ@mail.gmail.com>
To: John Crenshaw <johncrenshaw@priacta.com>
Cc: Richard Lynch <ceo@l-i-e.com>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] PHP Philosophy (was RE: [PHP-DEV] Scalar type hinting)
From: ronabop@gmail.com (Ronald Chmara)

On Thu, Mar 1, 2012 at 4:18 PM, John Crenshaw <johncrenshaw@priacta.com> wr=
ote:
> No, you've misunderstood. The average new not-really-a-developer has no c=
oncept of security. Every SQL query they write is vulnerable to injection. =
Every echo exposes their site to XSS vulnerabilities. Every form is vulnera=
ble to CSRF. If they did anything with files in their script I may be able =
to read arbitrary files to their server and/or upload and execute arbitrary=
 scripts. If they used eval() or system() I can probably execute arbitrary =
shell code and take control of the entire site. If their server is badly co=
nfigured I could capture the entire machine.
>

PHP is as vulnerable as you make it,

> This isn't a question of keeping software updated and not using deprecate=
d functions, this is a question of discipline that is completely missing am=
ong the "unwashed masses" as you call them. The intuitive way to handle man=
y of the most common PHP tasks is also the completely insecure way. Philoso=
phically, I wonder if we do a great disservice by encouraging these people =
to tinker with code at all. We do so knowing (or at least we should know) t=
hat anything they create will inevitably be hacked. We fuel the widespread =
security problems that currently plague the web.
>
> John Crenshaw
> Priacta, Inc.