Hacker News Reader

Comment by blub | Hacker News Reader

I don't know how it looked like in the US, but in several European countries the web was basically built in PHP. In 2005 the entire web market in my country was PHP with a few uncool Java enterprisey jobs here and there.

Being able to mix PHP and HTML code was brilliant and setting up PHP on a server was child's play compared to Java. Because state was stored in the DB and individual pages were ephemeral, we didn't have any issues with e.g. memory usage or performance. At that time I was already familiar with C, C++ and C# and I didn't find it worse to use PHP. It was a good match for the job.

View on HN

But the web was also made of SQLi and reverse shells in 2005 as well.

Nobody should argue the utility of using php in 2005; just as nobody should argue that it wasn't also a superfund site of a language in 2005 as well.

In 2020 the number one OWASP security risk is injection and I don't think anyone's arguing that the current crop of languages are all crap.

Evaluating a language without judging what kind of projects it enables is nonsensical and leads to pointless language ivory tower discussions. I'm sure that also back then there were all sorts of awesome programming languages that nobody was using, but checked all the boxes that would make the average HN language enthusiast happy.

As a counterpoint, the number one cause of death in America in 1950 was heart disease. It’s also the number one cause of death today. We’ve still made a lot of progress in treating heart disease in the last 70 years

What kind of progress have we made since 2005 in preventing (not treating) SQL injection? I remember reading a book about PHP security that year where escaping strings and bound parameters were mentioned.

Just don't construct SQL queries by directly concatenating user input. It's easy to mess up or use the wrong escape function, so always use prepared statements anywhere you want to pass user defined data.

You can usually grep or even use static code analysis to help find where your existing code is using "tainted" data to construct a query.

Also, if you use an ORM, you'll generally be working at a high enough level where SQL injection is impossible (unless there's a bug or design flaw in the ORM); since you won't be directly dealing with text queries.

I don't disagree that the web was basically built on PHP in 2005, but in 2020 that isn't really the case anymore.

Reply on news.ycombinator.com