I’ve been a professional programmer for over 30 years with some of the biggest companies in the world. I’ve worked with assembly, c, c++, c#, java, kotlin, perl, lua, haskell, rust, javascript, typescript, coffeescrpit, dart, php, python, and I’m sure 3 or 4 other languages I’ve just forgotten about at this point. Some of those languages are terrible and I hope never to touch again, others were great and I’d be happy to work with.
PHP should have been retired as a language 20 yeara ago, but WordPress has kept it alive all this time. The rest of the industry has moved on and learned lessons from what came before, but the sheer momentum of hundreds of thousands of WordPress installs has somehow kept PHP alive. The language started as a hack, and it remains a hack. It’s gotten faster over the years, but it’s still just as badly designed today as it was when it was originally created.
As a security auditor, I would have specified that it’s the OLD php plugins/scripts extensibility that was the mess. And similar to CGI, PHP used to be a problem for infosec audits because it was usually so full of configuration holes that the mantra just became “Don’t use PHP”. AJAX implementations are also rife with security issues because of configuration errors. So is a default implementation of nginx.
But PHP gets the bad rep because it was hands down the most popular way to add custom functionality to a webapp during the time when infosec became a more widespread profession, a victim of its own success.
As an aside, a default install of PHP on reasonably modern Linux today is a hell of a lot more secure than it was in 2009. I know this because I did the comparison for a presentation to my peers in 2023.
This is the problem with extensible platforms that allow you the freedom to build what you want: their success is built on being malleable, which brings with it a lot of problems people with experience know to patch up, but less experienced people don’t.
You have no idea what you’re talking about.
I’ve been a professional programmer for over 30 years with some of the biggest companies in the world. I’ve worked with assembly, c, c++, c#, java, kotlin, perl, lua, haskell, rust, javascript, typescript, coffeescrpit, dart, php, python, and I’m sure 3 or 4 other languages I’ve just forgotten about at this point. Some of those languages are terrible and I hope never to touch again, others were great and I’d be happy to work with.
PHP should have been retired as a language 20 yeara ago, but WordPress has kept it alive all this time. The rest of the industry has moved on and learned lessons from what came before, but the sheer momentum of hundreds of thousands of WordPress installs has somehow kept PHP alive. The language started as a hack, and it remains a hack. It’s gotten faster over the years, but it’s still just as badly designed today as it was when it was originally created.
As a security auditor, I would have specified that it’s the OLD php plugins/scripts extensibility that was the mess. And similar to CGI, PHP used to be a problem for infosec audits because it was usually so full of configuration holes that the mantra just became “Don’t use PHP”. AJAX implementations are also rife with security issues because of configuration errors. So is a default implementation of nginx.
But PHP gets the bad rep because it was hands down the most popular way to add custom functionality to a webapp during the time when infosec became a more widespread profession, a victim of its own success.
As an aside, a default install of PHP on reasonably modern Linux today is a hell of a lot more secure than it was in 2009. I know this because I did the comparison for a presentation to my peers in 2023.
This is the problem with extensible platforms that allow you the freedom to build what you want: their success is built on being malleable, which brings with it a lot of problems people with experience know to patch up, but less experienced people don’t.