What attributes of PHP make it insecure? [closed]

Question

It's well known and discussed that PHP has a poor history with relation to security. Is it not a secure language, or are there other reasons for this (such as developer error)?

If PHP is truly insecure, what are the reasons that make it such?

Answer 1

"PHP is as secure as any other language if used correctly"

Sorry, but that's absolutely not true. For example recent, very embarrassing security breach

We found that giving the query string ‘?-s’ somehow resulted in the “-s” command line argument being passed to php, resulting in source code disclosure. We explored this bug further and managed to improve our exploit to remote code execution, and trace the bug to a PHP commit in 2004

And what's further embarrassment to PHP security, is that a patch took 3 months and still doesn't fix the problem!

If you compare for example PHP with Python:

• in whole history of Python there have been only 2 security issues with the interpreter itself, last of them in 2006;

• PHP has had 4 serious security problems (including remote code execution) in just last 3 months alone (CVE-2012-0830, CVE-2012-1172, CVE-2012-1823, CVE-2012-0831), and past security track doesn't look any better (in fact it looks even worse).

It is also clear that PHP devs either do not take security seriously, or are seriously inept.

• As I've already mentioned, patch for CVE-2012-1823 took 3 months and didn't fix the flaw.
• CVE-2012-0830 was a remote code execution flaw introduced in a security fix for DoS attack!
• some of the security fixes could be something for DailyWTF.

btilly's answer suggest, that PHP is not secure because of so many newbie programmers using it. While indeed it does add to PHP's perception as insecure, you can see from above it's not the only reason. All of above are security flaws in the PHP itself and cannot be avoided just by good programming practice.

Excellent article "PHP: a fractal of bad design" also mentions security in the language design itself.

Answer 2

A very similar topic was discussed at What resource is teaching this poor coding? and I still think that my answer has a reasonable explanation of what is going on. (td;lr version, whatever language is most productive for beginners will wind up with a high concentration of useful stuff with a lot of bad beginner mistakes. Currently that language is PHP.)

Answer 3

The bigger problem is that web app development in general suffers from really bad security practices. How many apps have you seen that do whitelist validation of all input parameters? Web app security is about a LOT more than just avoiding sql injection (even though many app developers are still struggling with that one).

PHP is not inherently insecure, but the problem is that it's not inherently secure either. We're slowly working our way towards OWASP ASVS level 2 compliance, and we've had to do an awful lot of work that should have been part of the "standard" toolset. It's too easy to blame app developers for not knowing how to use PHP securely, because there's just too much knowledge to master.

And then there's the matter of PHP books and tutorials, of which I've seen almost none that had halfway decent security practices. It's a really sad state of affairs. But, blaming PHP wouldn't be right, because the other web platforms aren't much better. It's just how web development is, horribly insecure.

Answer 4

Meanwhile, in today's news:

MySQL.com hacked using SQL injection; That site is running PHP/5.2.13.

So much for "not safe only for newbie users" argument.

Answer 5

I dont know that you can say with certainty that sites are targetted specifically because they are written in PHP. It may just be that the most popular open source web apps (phpbb, etc) are targetted, and they happen to be written in PHP.

That being said, earlier versions of PHP didnt support parameterized database queries, making it much simpler for someone to use SQL injection. Combine that with a lot of novices and webmasters who know just enough PHP to install an open source app, and you get yourself a lot of nice juicy targets.

Answer 6

Because PHP

• has a low entrance barrier, thus allowing unexperienced coders to quickly throw together a site, leaving a lot of security holes
• suffers from many bad tutorials out there, which make the previous effect even worse
• allowed/encouraged extremely insecure request processing
• has had severe security issues, that allowed code injection
• is widely spread, all the while most installations are outdated and thus provide a number of well documented security issues

So PHP itself is not insecure. Vast parts of the standard library (that are written in C) however have serious problems (not being binary safe, not properly handling over- and underflows, etc.).

If you keep your version up to date and programm carefully (or have a framework handle the sensible parts), you can make a site secure.

Answer 7

A language is only as secure as the ability of the programmer to employ security techniques. Much focus in the development of PHP is on reducing security risks. Unfortunately there are so many ways which hackers are able to get around different defenses that its very difficult for any language to be equipped (and for programmers to use those developments correctly) to prevent successful attacks all of the time.

The programmer is just as responsible for security risks if he/she doesn't adapt when risks are discovered. I think that can be expanded to say they're at fault if they're not actively looking for risks as well however this is sometimes difficult as projects don't tend to pay for that kind of up keep. So not only the language, but also the programmers, must adapt to thwart attacks.

Often times the language is upgraded much more often than the distributed installations are. There are still installations of PHP4 out there that I'm personally aware of (likely older versions are still around as well). It doesn't matter how secure a language is if you're using old versions.

All in all php is a secure language if used correctly (just as it is with any other language).

Answer 8

I disagree with the argument "the only reason is the popularity with beginners", although that does have a big influence. The real reason for the bad reputation is in PHP's, and popular PHP software's, disregard for security in the past.

In the beginning PHP was not designed to be secure. You had for example GET/POST/Cookies imported as globals. No validation at all. Later on that was fixed, by adding directive for that, since few version by default off. Lack of validation was "fixed" by dirty hacks like magic_quotes_gpc. Also PHP's weird comparison semantics and type juggling didn't help much, many newbies would have code like if("secret_pass" == $_REQUEST['password']), which condition would be true if you pass 0 as password. That has been fixed by another dirty hack -- identity operator (===). As you look at history of PHP you'll see many similar examples of lack of consideration for security, which later are being patched by some dirty hack.

Another big blow to PHP security reputation came few years ago from popular software like phpBB or PHPNuke (and derivates). Both of which had terrible security record, having exploits like SQL injection or remote code execution. They have been target of few worms, thousands of sites were infected.

Answer 9

What the others have answered is fundamentally true: poor programming brings bad security, period.
But reputation is another thing; I think that much of PHP's bad reputation about security is the consequence of a long history of exploits of high-profile PHP applications with huge install bases, which is in turn the result of the great popularity of PHP.

Answer 10

Well I think most of it is bad propaganda, I do agree that PHP has a lot of flaws and need much reworking but it's not a zombie menace, look at projects like Magento and Wordpress.

I do think there's valid criticism, but the PHP hate is in a much more religious level, look at our major collaborator Vartec here, his argument is compelling and the CVE data is really impressive, but he failed to account semantics on the CVE website search engine.

We should all stop using HTML because well, we have 6346 vulnerabilities catalogued.

I mean, bible.php and BlackForest WP theme are core features that come with every PHP installation.