<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.12.0">
</HEAD>
<BODY>
On Thu, 2007-01-11 at 10:34 -0500, John Van Ostrand wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
<FONT COLOR="#000000">On Thu, 2007-01-11 at 10:06 -0500, Lennart Sorensen wrote:</FONT>
<FONT COLOR="#000000">> I like php. Nice easy to use web programming language. However</FONT>
<FONT COLOR="#000000">> security really has been a disaster for it. For example an article from</FONT>
<FONT COLOR="#000000">> today:</FONT>
<FONT COLOR="#000000">> <A HREF="http://www.theregister.co.uk/2007/01/11/php_apps_security/">http://www.theregister.co.uk/2007/01/11/php_apps_security/</A></FONT>
<FONT COLOR="#000000">> </FONT>
<FONT COLOR="#000000">> Rather scary. Easy to use and not secure by design, means people who</FONT>
<FONT COLOR="#000000">> don't understand security issues will still be able to make programs</FONT>
<FONT COLOR="#000000">> that they believe are working just fine. Bad idea.</FONT>
<FONT COLOR="#000000">I don't think PHP is the problem. Its popularity combined with sloppy</FONT>
<FONT COLOR="#000000">coding is the cause of the large number of exploits. The article even</FONT>
<FONT COLOR="#000000">states this. Perhaps one can say that sloppy web coders choose PHP.</FONT>
<FONT COLOR="#000000">It would be nice if a language made it easy to program more securely.</FONT>
<FONT COLOR="#000000">Take one of the common exploits, SQL code injection. A programmer</FONT>
<FONT COLOR="#000000">displays an HTML form, accepts data from it and uses that data in an SQL</FONT>
<FONT COLOR="#000000">statement without checking.</FONT>
<FONT COLOR="#000000">Aside from Perl (with non-default settings), what language helps to</FONT>
<FONT COLOR="#000000">force the user to clean the data first?</FONT>
</PRE>
</BLOCKQUOTE>
<BR>
I should have read more deeply into that article. PHP can do a lot more to be secure and that is evident from the Suhosin project. There are far more exposed vulnerabilities than I realized. It looks like Suhosin has experimental support for SQL code injection problems like what I mentioned.<BR>
<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
-- <BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="400">
<TR>
<TD>
<B>John Van Ostrand</B>
</TD>
<TD ALIGN="right">
<B><A HREF="http://www.netdirect.ca/">Net Direct Inc.</A></B>
</TD>
<TD>
</TD>
</TR>
<TR>
<TD VALIGN="top">
<I>CTO, co-CEO</I>
</TD>
<TD ALIGN="right">
564 Weber St. N. Unit 12<BR>
Waterloo, ON N2L 5C6
</TD>
<TD VALIGN="top">
<A HREF="http://maps.google.ca/maps?q=Net+Direct+Inc.,+564+Weber+St.+N.+Unit+12,+Waterloo,+ON+N2L+5C6,+canada&ll=43.494599,-80.548222&spn=0.038450,0.073956&iwloc=A&hl=en">map</A>
</TD>
</TR>
<TR>
<TD>
<A HREF="mailto:john-Da48MpWaEp0CzWx7n4ubxQ@public.gmane.org">john-Da48MpWaEp0CzWx7n4ubxQ@public.gmane.org</A>
</TD>
<TD ALIGN="right">
Ph: 519-883-1172
</TD>
<TD>
ext.5102
</TD>
</TR>
<TR>
<TD>
<A HREF="http://www.netdirect.ca">Linux Solutions / IBM Hardware</A>
</TD>
<TD ALIGN="right">
Fx: 519-883-8533
</TD>
<TD>
</TD>
</TR>
</TABLE>
</TD>
</TR>
</TABLE>
</TD>
</TR>
</TABLE>
</BODY>
</HTML>