this post was submitted on 10 Oct 2023
70 points (88.9% liked)

Technology

59287 readers
4106 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago
MODERATORS
L3s@lemmy.world
L3s@fry.gs
L4s@fry.gs
L4s@lemmy.world
enu@lemmy.world
70
How is the security level of PHP in 2023? (lemm.ee)
submitted 1 year ago* (last edited 1 year ago) by redballooon@lemm.ee to c/technology@lemmy.world
23 comments fedilink hide all child comments
 

In the early 2000s, everyone in my bubble knew that PHP was a security nightmare, only seconded by Flash. In the meantime, Adobe gave up on Flash, but PHP is still alive and rocking.

How did that happen? Did PHP get some serious makeover? Do developers just not care?

you are viewing a single comment's thread
view the rest of the comments
[–] bus_factor@lemmy.world 48 points 1 year ago (8 children)

Some things got better. The magic variables, the killer feature which popularized PHP and also introduced the most vulnerabilities, has been gone for more than a decade. It's not nearly as easy to accidentally make a vulnerability now. WordPress is still horrific, though.

But the reason PHP is still around is simple: There's not much competition. mod_php is still by far the most convenient way to run shared hosting. You just install the module, and people can put .php files on their website and it just works. No need to set up FastCGI, some servlet engine, reverse proxy or any of that jazz you need when using python, ruby or node.js.

Sure, if you're running your own VM somewhere, you can set all that up, but a lot of people are still on cheap, shared hosting, where all they can do is upload files via FTP. The only real scripting language which doesn't need any server software configured is PHP, so that's what those hosting providers support.

[–] Potatos_are_not_friends@lemmy.world 3 points 1 year ago* (last edited 1 year ago) (1 children)

WordPress is still horrific, though.

Not wp core, or the latest core themes. Very stable, security issues are resolved pretty quickly and it's only getting better for the past few years.

But Everything where users can contribute, plugins and themes can be garbage. Especially on the open market. Php development into WP core... still kinda nightmarerish. But modern theme development with php is a great experience. Modern themes also recommend moving the frontend templating to JavaScript.

Nearly 99% of my security audits on wp sites is looking for vulnerability from a decade ago.

So in terms of security, WP core itself has been incredibly stable.

load more comments (6 replies)