It’s the top hit for “PHP MySQL tutorial”. This is what PHP newbies are learning from.
The same tutorial with Django wouldn’t have the same problem because Django auto-escapes strings you dump into HTML. These vulnerabilities only exist in this tutorial because PHP treats its output as HTML by default not text, so you need to put in extra effort to be secure.
That are the top hit on Google for a common beginner query and contain multiple vulnerabilities caused by a flaw unique to the language?
And we aren’t talking about an article, we’re talking about a tutorial. There’s a very big difference between the two, why are you switching? Tutorials are obviously vastly more important to beginners.
Let me remind you of the context:
> > Mixing server side and front end code is bad news. I think following many PHP-MySql tutorials will result in SQL injection vulnerabilities. Not good.
> i think you'd have to go back at least a decade to find tutorials that bad
This is something that is harming people learning PHP today, not the distant past.
The same tutorial with Django wouldn’t have the same problem because Django auto-escapes strings you dump into HTML. These vulnerabilities only exist in this tutorial because PHP treats its output as HTML by default not text, so you need to put in extra effort to be secure.