Hacker News Reader

Comment by bhhaskin | Hacker News Reader

One reason I migrated away from php is the fact that there is simply way too many attack vectors. Using frameworks help quite a bit, but it is to easy to miss configure a stock php install. Not saying that is the case here though.

View on HN

we have no proofs that is related with the fact that the domain has been blacklisted by google

You are correct. Like I said, I doubt that is the case. Php can be very secure if configured correctly.

that's the issue, PHP should be secure(ie restrictive) by default, Linux style... it is not. PHP+Apache => recipe for disaster. PHP is a templating language yet doesnt do html sanitizing by default !

95% of compromised websites are PHP ones.

That's the reason why PHP will die eventually,when businesses understand while it's cheap to go online with a PHP cms, once you get hacked , it will cost you your business.

It's "tagged" by Google. When I search php from the iPhone I get:

"PHP: Hypertext Preprocessor

php.net/

This site may harm your computer.

Server-side HTML embedded scripting language. It provides web developers with a full suite of tools for ..."

Google inserts the "harm" note.

Yes, but there are quite a few ways to get flagged by Google.

you do realize that this is a javascript exploit? just sayin.

You'd have to be pretty stupid to think this is exploting some sort of PHP bug.

OMG! Did I just defend PHP? Gotta go take my medication.

and how did the js exploit end up on their servers? through php code likely.

That's speculation. I've seen servers get compromised due to FTP problems, SSH misconfiguration, unpatched Apache vulnerabilities, third-party stats monitoring software with 0-days and even SQL injection.

Defacement (I consider malware injection a form of defacement) isn't unique to PHP by a long shot.

This is ridiculous speculation on your part, you can't speculate with security, for all you know the webmaster's ex-girlfriend could have inserted the malware.

Yes. It was more of a general statement.

and you now using sql-prepare-query instructions after escape from php?

Using Django ORM. if you haven't used an ORM before you are missing out.

... you know PHP's supported PDO for a while now, right?

when many attacks are occurs it is going more interesting...

curious what you are using now?

Currently using Django. Once I started playing around with it I haven't looked back. Although I am told cake php and a few other frameworks really do improve php.

I'm tempted to say: they improve programmers.

they dont improve PHP. you still have to deal with PHP shortcomings even with a framework. But since you dont deal with low level stuffs your code might be more secure yeah.

PHP has too many unsecure apis accessible to beginners.

With Django for instance you have a view layer with auto escaping by default.You dont write unsecure SQL queries ,..., That makes a huge difference.

Reply on news.ycombinator.com