Slashdot Mirror

← Back to Stories (view on slashdot.org)

Month of PHP Bugs Has Begun

Posted by Zonk on from the quick-hide-the-furniture dept.

An anonymous reader writes "The previously announced Month of PHP Bugs started three days ago, and already lists 8 security vulnerabilities in PHP and PHP related software. From the site: 'This initiative is an effort to improve the security of PHP. However we will not concentrate on problems in the PHP language that might result in insecure PHP applications, but on security vulnerabilities in the PHP core. During March 2007 old and new security vulnerabilities in the Zend Engine, the PHP core and the PHP extensions will be disclosed on a day by day basis. We will also point out necessary changes in the current vulnerability management process used by the PHP Security Response Team.'"

4 of 165 comments (clear)

  1. Defective by Design? by Ckwop · · Score: 4, Interesting

    We see a lot of people use the phrase "defective by design" when talking about Vista and in that instance I'm pretty sure the use of the term is correct.

    Having never used PHP but heard of its many security problems I'm wondering: Is PHP defective by design? If so, why so and how would Slashdot seek to fix it?

    Simon

    1. Re:Defective by Design? by julesh · · Score: 4, Interesting

      I think PHP has got beyond the stupid-design-flaws-causing-security-issues stage. Now, as you correctly point out, the major issue is endemic insecure programming practices and a lack of attention to bug reports.

      How I wish we could just junk the language and start again with something else; unfortunately, market pressures being what they are, I'm afraid we're stuck with it, at least for the time being.

    2. Re:Defective by Design? by nuzak · · Score: 4, Interesting

      Done. http://www.caucho.com/resin-3.1/doc/quercus.xtp

      --
      Done with slashdot, done with nerds, getting a life.
  2. Re:Parent isn't flamebait by Aladrin · · Score: 4, Interesting

    So your webhost won't upgrade, and that's PHP's fault? PHP5 has been out a LONG time. Don't bother complaining about bugs in PHP4 simply because your website can't be bothered to upgrade. Find a decent webhost instead.

    strpos() return FALSE when it can't find the 'needle'. http://us2.php.net/strpos Use a proper test (===) and you'll have all you need in a single statement.

    Some people really LIKE dynamically-typed variables. It's not a bug or a problem. It's a design choice.

    Your flamebait at the end (vbscript) does nothing to enhance your argument. Leave it off next time.

    --
    "If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM