PHP web site compromised

PHP web site compromised

Of course, most PHP coders aren't worth their salt, and out in the wild there is a lot of code where people simply never consider XSS or SQL injections or whatever else can come from the cruel world. But, how is that a problem of PHP?

It's a problem with PHP because PHP entices people who are not used to worrying about security and correctness to begin programming. Instead of easing them in to concepts like these most of the PHP world seems dedicated to misinforming them, or ignoring the problem entirely, leading to a situation where more and more bug-riddled code is produced.

The problems with PHP as a language are a few minor things mostly in the implementation, like not being noisy enough when bad things could happen (my favorite example: use of undeclared variables), but the problem with PHP culture is a systemic lack of interest in correctness. Most new PHP programmers will go to php.net and read the documentation, which happily documents use of built-in functions in unsafe ways, and then perhaps will copy/paste some of the snippets from the comments section, which are often naive or buggy. I can't blame the language directly for these things, but the culture surrounding the language is such that no one appears to think it's a problem and more and more new programmers learn the same bad practices every day.

If PHP is where a person learns programming, or learns web development, as appears to often be the case, he will spend months or years unlearning bad habits and learning how to produce good code... if he is dedicated enough to do so and doesn't just stop learning once he knows enough to be dangerous. It's a waste and a shame, and I blame PHP for the fast-and-loose attitude that allows bad practices to continue unchecked. Perhaps it's unfair of me.