Hacker News Reader

Unfortunately something as simple as input validation often does not occur. It baffles me when I look over at code from contract work or I come into a new job and see GET requests modifying the database, and POST's going completely unchecked. Madness!

View on HN

what bothers me most about the PHP community is that it's taken for granted that you should have to do all that yourself from scratch every time.

i think that any php developer who uses any substantial framework would disagree with you.

most PHP developers don't use frameworks. there have been no "substantial frameworks" for nearly all of PHP's history, and the attitude among common users is that PHP isn't responsible for helping you out with security.

it doesn't help that coding style in nearly every PHP book I've seen is insecure and unmaintainable.

Reply on news.ycombinator.com