In the early 2000s, everyone in my bubble knew that PHP was a security nightmare, only seconded by Flash. In the meantime, Adobe gave up on Flash, but PHP is still alive and rocking.

How did that happen? Did PHP get some serious makeover? Do developers just not care?

  • @TheEighthDoctorEnglish
    23•1 year ago

    PHP is as secure as any other language, the problem is the implementation of it.

    For example I can upload a file to a webserver and the webserver is executing it instead of just reading it as text, It can be php, aspx, ruby, flask, doesn’t matter, from the point of view of the attacker the only thing that changes is which webshell he will upload.

    Regarding your experience, everything was a security nightmare in the early 2000’s PHP was no exception.

    • lemmyvoreEnglish
      0•1 year ago

      For example I can upload a file to a webserver and the webserver is executing it instead of just reading it as text, It can be php, aspx, ruby, flask,

      You do realize that only works for .php right? There no way to tell a Ruby or Python etc. app to run a file it wasn’t designed to run.

      • @TheEighthDoctorEnglish
        2•1 year ago

        You are kinda right I didn’t know it was not possible on ruby (at least without chaining vulns), but it’s possible on aspx, jsp and pearl at least.