Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

A friend of mine while working on a PHP application asked me to write one part of the application in Java. The part that involved transactions. He said it will be better to write this portion in Java. He talked about how secure it will be!

Though I was too busy to help him then, I want to know the essence of this idea. Why he was trying to use Java when he wrote the most part in PHP? Will it really boost up the security? And writing transactions in Java is only concerned with security?

The thing seems very interesting but I really have no idea, what it is! Please provide some insight into the topic.

Note: When I say transaction, it involves everything. From accessing account to transferring money.

share|improve this question
5  
Languages aren't secure (or insecure). Poorly written Java will be just as exploitable as poorly written PHP. –  Mat May 26 '13 at 7:17
    
@Mat I agree. But I have heard web applications using both PHP and Java. Why is that ? –  Suhail Gupta May 26 '13 at 7:22
    
Why not? Some things might be more practical to code in Java for any number of reasons. –  Mat May 26 '13 at 7:23
4  
@btilly: breaking news: software has bugs! –  Mat May 26 '13 at 8:27
1  
@btilly I'd rather they patch them than not. Of course it isn't a good sign when a number of security-related patches are needed in a short period of time, but what if they didn't fix those bugs? Would that be better? I would argue that it would not be better for the bugs to go unfixed. –  Michael Kjörling May 26 '13 at 14:22

3 Answers 3

Correctly utilizing a Language's strong type system goes a long way towards reducing certain types of bugs - variants of the "provided the wrong argument to that method" bugs.

For example, think of the following function:

transfer_money(from_account, to_account, amount)

In an weakly-/untyped language, it's easy to confuse the from_account and to_account parameters; It's also common to use wrong units in amount (Dollars vs Cents, for example).

These errors would require rigorous testing to be found, or very thorough manual code-reviewing.

OTOH, an (extreme) use of types will result in this kind of method:

transfer_money(SourceAccount from_account, 
               TargetAccount to_account,
               MoneyAmount   amount)

The same kind of errors here will produce a compilation error, which makes them a lot less likely to actually reach production.

Now, this isn't to say that Java is inherently safer than PHP; Nor that a similar system cannot be easily implemented in PHP; Nor that it's actually common to use types in this fashion in Java; But it does give Java a tiny edge over PHP for critical paths of code. From a Safety Engineering POV, it makes Java "safer".

share|improve this answer
    
This is built into PHP as well (type hinting) –  Adrian Schneider May 27 '13 at 18:31

I don't think there's any truth behind that idea. Two main things that would be different by using Java are the JVM and the code itself.

  1. JVM. I'm not an expert in the details of jvm but there are PHP implementation for jvm (e.g. http://www.caucho.com/resin-3.1/doc/quercus.xtp). They promoted security as one of the feature but they only pointed out buggy php extensions, i.e. not flaw in PHP itself.

  2. The code. If your friend can code secure transaction in Java, you should be able to re-implement it in PHP and it will have the same level of security (good or bad). It's pretty straight forward to check that the two implementations have same behavior, although proofing them to be secure is a whole different story.

Especially within the transaction code scope, I don't think there is proof that Java is inherently more secure than PHP.

share|improve this answer

One area coding in Java can be considered more secure is in the region of file storage.

With Java, a byte-code file can be stored where the program will be run. If a compiled Java file is found, it can only be run with a Java virtual machine, and not read or easily reverse engineered.

In PHP, a script file filled with readable text is what is stored. So if somehow the file was found, then the program could be read with a simple text editor like Notepad or Emacs.

What this means for security is that the inner workings of the program would be hidden if written in Java. And only in the event that someone had access to the program file. Normally, with PHP the program exists on a web server and is executed without visibility in a Web Browser. Your friend, however, probably wants to be extra careful.

share|improve this answer
5  
"not read or easily reverse engineered" - eh, no, java class files can be decompiled and/or analyzed very, very easily. If someone manages to download them, you're really not much better off than if they downloaded your PHP source. –  Mat May 26 '13 at 7:16
    
Hrm, if language differences aren't the key, then maybe he was considering the use of a specific module he felt was more secure. My guess is each language probably has hundreds of encryption or security libraries each. –  user92106 May 26 '13 at 7:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.