this post was submitted on 10 Oct 2023
69 points (88.8% liked)

Technology

58055 readers
4766 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago
MODERATORS
L3s@lemmy.world
enu@lemm.ee
L4s@lemmy.world
fry@fry.gs
L3s@fry.gs
enu@lemmy.world
L4s@fry.gs
69
How is the security level of PHP in 2023? (lemm.ee)
submitted 11 months ago* (last edited 11 months ago) by redballooon@lemm.ee to c/technology@lemmy.world
23 comments fedilink hide all child comments
 

In the early 2000s, everyone in my bubble knew that PHP was a security nightmare, only seconded by Flash. In the meantime, Adobe gave up on Flash, but PHP is still alive and rocking.

How did that happen? Did PHP get some serious makeover? Do developers just not care?

you are viewing a single comment's thread
view the rest of the comments
[–] TheEighthDoctor@lemmy.world 23 points 11 months ago* (last edited 11 months ago) (1 children)

PHP is as secure as any other language, the problem is the implementation of it.

For example I can upload a file to a webserver and the webserver is executing it instead of just reading it as text, It can be php, aspx, ruby, flask, doesn't matter, from the point of view of the attacker the only thing that changes is which webshell he will upload.

Regarding your experience, everything was a security nightmare in the early 2000's PHP was no exception.

[–] lemmyvore@feddit.nl 0 points 11 months ago (1 children)

For example I can upload a file to a webserver and the webserver is executing it instead of just reading it as text, It can be php, aspx, ruby, flask,

You do realize that only works for .php right? There no way to tell a Ruby or Python etc. app to run a file it wasn't designed to run.

[–] TheEighthDoctor@lemmy.world 2 points 11 months ago

You are kinda right I didn't know it was not possible on ruby (at least without chaining vulns), but it's possible on aspx, jsp and pearl at least.