Technology

59161 readers

2133 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

How is the security level of PHP in 2023? (lemm.ee)

submitted 1 year ago* (last edited 1 year ago) by redballooon@lemm.ee to c/technology@lemmy.world

23 comments fedilink hide all child comments

In the early 2000s, everyone in my bubble knew that PHP was a security nightmare, only seconded by Flash. In the meantime, Adobe gave up on Flash, but PHP is still alive and rocking.

How did that happen? Did PHP get some serious makeover? Do developers just not care?

you are viewing a single comment's thread
view the rest of the comments

[–] redcalcium@lemmy.institute 8 points 1 year ago (1 children)

The main threat to PHP apps now are bots attempting to exploit your app to upload executables or PHP files and somehow execute them. But this is not the fault of PHP itself though, more like the app handling uploaded files in insecure manner and can happen to other apps written in other languages.

[–] lemmyvore@feddit.nl -2 points 1 year ago (1 children)

Actually, it can't happen in other languages. It's quite unique to PHP because it relies on a webserver to run, and that webserver will execute any file ending in .php as PHP code.

Other languages' web engines don't work like that. Assuming you manage to trick a Java or Node etc. into accepting a file ending in .java or .js and so on, you won't be able to make it execute. The attempt doesn't even make sense because those platforms don't have a concept of allowing remote requests to indicate which file should run.

[–] redcalcium@lemmy.institute 3 points 1 year ago* (last edited 1 year ago)

There are other backend languages that works like php in this regard such as ASP and CGI scripts (Perl, etc). Basically, if you have a bug that can be exploited to replace the app source code or binary, your backend will have similar vulnerability unless your backend uses a strict process control system (only loads source code / binary files on backend start and ignore subsequent file updates), which is the default for many backend languages these days but not all of them.