1. PHP is the "serious" or at least open-source/Linux/security freak's
choice for web development. Mine as well (although as many still say, Perl
does a better job).
While PHP is extremely popular, especially in open-source and Linux communities,I am not sure it qualifies as the defacto choice of "serious" web developers.
And I did not think it was as popular in the security community (when I
occasionally scan one of the reports on the frequent PHP based applications
that grace this list, I thought exploit code is as often as not given in
Perl:)
2. Developing secure applications in PHP is difficult, as one of PHP's
creators said recently - even to him after years of trying.
The number of PHP applications getting reported on bugtraq would seem to
support this, although likely also contributed to the fact that it is popular,
and perhaps that it is (or at least has the reputation of being) of being
easy to program, leading to programs written by people without understanding
of security implications.
My personal knowledge of PHP is somewhat meager, but having had to install
it recently for a developer I find the philosophy of the PHP security options
to be somewhat odd. It almost seemed like the emphasis was on distrusting
the programmer rather than the person running the program. I think it would
strongly benefit from the Perlish concept of data tainting.
3. Staying on top of new PHP vulnerabilities has become impossible, popping
around everywhere.
While I concede I am less than happy about the frequency with which patched
versions of php come out, and most versions include some security related
patches, I do not think it is impossible. Furthermore, most of the "security"
patches have been rather localized, and affect only a small number of functions
and often only in rather specific circumstances, and with some knowledge of the
PHP applications running on your system you can often leap frog over some
of the versions.
Most bugtraq messages with PHP in the subject appear to be holes in specific
applications, usually due to programming errors on the part of the application
author. This does not mean the language is inherently insecure; although it
may indicate that it is difficult to write secure PHP code. It could also
mean that PHP is easy enough to program that a lot of people without knowledge
of how to program securely are writing PHP code.
Tom Payerle
Dept of Physics payerle@physics.umd.edu
University of Maryland (301) 405-6973
College Park, MD 20742-4111 Fax: (301) 314-9525
