Re: PHP on i and security

[Scott <scottgcampbell@xxxxxxxxx>]

As Jon said PHP itself is not inherently insecure it is the applications 
built on top that MAY contain security issues.  Have someone review your 
code and learn (http://shiflett.org/ for example) what to do and what 
not to do.  If you download and install a packaged application from 
somewhere be sure to watch for known security issues 
(http://isc.sans.org/ and http://secunia.com/advisories/ for example) 
and download and install patches when they are issued. 

Scott

Jon Paris wrote:
> > Mike Cunningham wrote:
> >     
> > > We are considering using PHP on i for some new development, but a
> > > colleague has raised a concern about the security of PHP
> > > applications. He remembers past stories about lots of security holes
> > > on PHP applications, and scripted attacks against php web
> > > applications. He does not know if these flaws were due to just bad
> > > design/coding on the part of the developer or something inherent in
> > > the way PHP works. Does anyone on this list have any experience in
> > > this area?
> > >       
>
>
> As Scott notes, most of the web security issues that currently afflict  
> PHP applications are a function of poor programming and could occur in  
> any language. The security related PHP specific issues are long-since  
> gone - but Java fanatics love to point them out still.
>
> If you want to pursue the topic in more depth, this month's PHP  
> Architect magazine features security and includes an article with the  
> challenging title "Who says PHP Security Sucks?" which has the  
> extended title ("deck" I think) of "Who would say such a thing?  
> Obviously, we can't let that stand. It's time to bust some myths while  
> raising our own game to the next level." You can find the details  
> here: http://www.phparch.com/c/magazine/issue/95 - You can buy this  
> single issue as a download for only $4.99 - a good deal if you are  
> concerned over PHP security issues.
>
>
> Jon Paris
>
> www.Partner400.com
> www.SystemiDeveloper.com
>
>
>