Hacker News new | ask | show | jobs
by nicce 1665 days ago
Statistically PHP software has the most vulnerabilities. They are also quite different when compared to other languages. Language has many features which might be used unintentionally by programmer, leading for serious bugs. Not a good language to start with.
1 comments
ipaddr 1665 days ago
What features are used unintentionally leading to serious bugs?
link
emodendroket 1665 days ago
The ease of the "just put it on the filesystem and it can be run!" system also opens up security vulnerabilities when people want to enable file uploads, for instance. I think the proliferation of places you can put configuration for the runtime is also a potential source of issues, as are various forms of string escaping that should be avoided.
link
nicce 1664 days ago
Take a look for https://book.hacktricks.xyz/pentesting/pentesting-web/php-tr... for example. (Note also, that is the only programming language specific list, which is one mile long.)
link
ipaddr 1664 days ago
These are older issues. When you see comments like: This bypass was tried apparently on PHP 5.2.5 and I couldn't make it work on PHP 7.3.15) I'm not sure these apply anymore. The loose == vs strict === exists in many languages. You can make the same mistake in Javascript.
link