Re: is PHP less secure than Perl, Python, or Ruby?

walterbyrd wrote:
I honestly don't know. But, I have seen articles and posts about how
PHP is terribly insecure. I don't usually see comparisons to other
common web languages.

I think the big vulnerablity is supposed to be code injections.

Another security issue would be having code stolen, but I think that
PHP can be protected from that.

Obviously, I don't know a lot about it.


Walter,

As Mike says, it's only as secure as you write it. To elaborate a little more:

Security is not really a language issue - any language can be insecure, even a compiled one such as C/C++. And any language can be secure.

All scripting languages tend to be less secure only because the source code is there to see. Anyone with physical access to the server physically or through non-web routes such as telnet/ssh or ftp can get that source code (this includes hosting companies). Sure, they can get a compiled code also - but that takes a lot more work to figure out what's going on.

The only "secret" to security is the same in all languages. Understand the language. Understand the vulnerabilities (such as SQL injection - a potential problem in ANY language when you're using a SQL database). And understand how to secure your code against those vulnerabilities.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@xxxxxxxxxxxxx
==================
.

Relevant Pages

  • Re: PHP as a secure language? PHP worms? [was: Re: new linux malware]
    ... What vulnerabilities in PHP? ... I think Gadi meant vulnerabilities in PHP applications; ... language doesn't make it particularly easy to write secure code. ...
    (Bugtraq)
  • Re: vulnerabilities
    ... To enumerate the ways in which a ... A language HAS vulnerabilities. ...
    (comp.lang.c)
  • Re: $ & _
    ... And holding up Javascript as an example of programming excellence is ... JavaScript is a most enjoyable language to craft excellent code. ... I suppose that the innumerable JavaScript associated vulnerabilities ... like the association between VB and viruses or between assembler and ...
    (comp.lang.c)
  • Re: vulnerabilities
    ... There are no vulnerabilities at all in a nonexistent language. ... here), or any other language, is the fact that it is accessible to humans. ...
    (comp.lang.cpp)
  • Re: [Full-Disclosure] Coding securely, was Linux (in)security
    ... >> security problems on every statement of every program is just as secure ... > matter how well the language is devised, ... programmers need to know how to program. ...
    (Full-Disclosure)