Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

It's well known and discussed that PHP has a poor history with relation to security. Is it not a secure language, or are there other reasons for this (such as developer error)?

If PHP is truly insecure, what are the reasons that make it such?

share|improve this question

closed as not constructive by gnat, Jim G., Thomas Owens May 4 '12 at 12:07

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

19  
Not knowing PHP, I think a lot of the security problems come from bad programming practice and not from faults in the language. –  Anto Mar 25 '11 at 20:26
29  
Because PHP is widely used by people with little or no programming experience – leading to a number of poorly built and vulnerable applications. –  Josh K Mar 25 '11 at 20:36
9  
Because beginners who program in PHP tend to like to copy/paste code that they found on the web without learning how the code works first and the people writing the example code don't take the time to flesh out the security details. –  Evan Plaice Mar 25 '11 at 21:40
7  
It's called bad programming and has nothing to do with PHP. –  faif Mar 26 '11 at 10:02
2  
@Anto: thing again -- cve.mitre.org/cgi-bin/cvekey.cgi?keyword=PHP –  vartec Mar 26 '11 at 21:40

10 Answers 10

"PHP is as secure as any other language if used correctly"

Sorry, but that's absolutely not true. For example recent, very embarrassing security breach

We found that giving the query string ‘?-s’ somehow resulted in the “-s” command line argument being passed to php, resulting in source code disclosure. We explored this bug further and managed to improve our exploit to remote code execution, and trace the bug to a PHP commit in 2004

And what's further embarrassment to PHP security, is that a patch took 3 months and still doesn't fix the problem!

If you compare for example PHP with Python:

  • in whole history of Python there have been only 2 security issues with the interpreter itself, last of them in 2006;

  • PHP has had 4 serious security problems (including remote code execution) in just last 3 months alone (CVE-2012-0830, CVE-2012-1172, CVE-2012-1823, CVE-2012-0831), and past security track doesn't look any better (in fact it looks even worse).

It is also clear that PHP devs either do not take security seriously, or are seriously inept.

btilly's answer suggest, that PHP is not secure because of so many newbie programmers using it. While indeed it does add to PHP's perception as insecure, you can see from above it's not the only reason. All of above are security flaws in the PHP itself and cannot be avoided just by good programming practice.

Excellent article "PHP: a fractal of bad design" also mentions security in the language design itself.

share|improve this answer
2  
That's not a language issue, but more an implementation issue. –  Ikke Mar 26 '11 at 19:01
9  
@Ikke: in case of PHP it's the same thing. There is no language definition as such. –  vartec Mar 26 '11 at 20:01
4  
@Ikke: nor any implementation that would be a real alternative to the one from Zend. –  vartec Mar 26 '11 at 20:44
2  
@jonathan: while buggy software written in PHP might not be exactly PHP fault, it is influenced by how whole PHP community works. Which in turn will affect you as PHP developer, unless you pretend to only use standard library without any 3rd party packages. You might also note, that most "Python" problems, aren't security issues with the Python interpreter itself either. In fact in last 6 years none of them is. –  vartec Apr 13 '12 at 11:58
1  
FYI, I've made lot of changes to the answer, removing the most controversial examples/arguments, adding more relevant ones. –  vartec May 4 '12 at 10:49

A very similar topic was discussed at What resource is teaching this poor coding? and I still think that my answer has a reasonable explanation of what is going on. (td;lr version, whatever language is most productive for beginners will wind up with a high concentration of useful stuff with a lot of bad beginner mistakes. Currently that language is PHP.)

share|improve this answer
    
@vartec's answer and an excellent article along the same lines disagree - The language is an absolute mess. Beginners won't know that (most such discussions look like flame wars even when they're using facts), so they use whatever they know/hear about/have installed already. –  l0b0 Apr 26 '12 at 14:15

The bigger problem is that web app development in general suffers from really bad security practices. How many apps have you seen that do whitelist validation of all input parameters? Web app security is about a LOT more than just avoiding sql injection (even though many app developers are still struggling with that one).

PHP is not inherently insecure, but the problem is that it's not inherently secure either. We're slowly working our way towards OWASP ASVS level 2 compliance, and we've had to do an awful lot of work that should have been part of the "standard" toolset. It's too easy to blame app developers for not knowing how to use PHP securely, because there's just too much knowledge to master.

And then there's the matter of PHP books and tutorials, of which I've seen almost none that had halfway decent security practices. It's a really sad state of affairs. But, blaming PHP wouldn't be right, because the other web platforms aren't much better. It's just how web development is, horribly insecure.

share|improve this answer
    
+1 for a well balanced answer. –  dan_waterworth Mar 26 '11 at 12:36
1  
@vartec you're really comparing apples to oranges in that django is reported to have been used in some 2500 websites this month while PHP is reported to be used in almost 26 million. With such a larger difference of course PHP will be the target of a greater number of exploit attempts. Its these exploit attempts that reveal bugs. I'd be willing to bet that PHP has a much larger R&D team than django does as well which is another thing that would factor into discovery of bugs. Just because they're not reported doesn't mean they don't exist. –  Kenneth Mar 26 '11 at 22:04
1  
@vartec - I'd be very impressed in any language that is secure by design. Sure, some have been designed with security in mind, but the best rule of thumb is: if a human can design it, a human can break it. Especially when software development and coding courses still haven't got round to ensuring security has as high a priority as performance or speed. –  Rory Alsop Mar 28 '11 at 10:57
7  
Django is a Python framework. Python is a language. PHP is a language. Please, do compare languages to languages, and frameworks to frameworks. If you play your framework card, I'll play mine: ZF, or Symphony (or some more, you choose). –  Carlos Campderrós Mar 28 '11 at 11:19
1  
Hmm, I have to give Vartec some credit here. PHP is both a language and a framework, given the 10.000+ functions it ships with that do all sorts of things that belong squarely in framework-land, many of which default to insecure behavior. I use very few of PHP's functions directly, preferring the Zend Framework API instead, and for me PHP is a secure and clean language. PHP's biggest failing is having insecure defaults, in settings and in API's. But it's not inherently insecure, because it can be used in a secure way without much effort. –  Joeri Sebrechts Mar 28 '11 at 16:43

Meanwhile, in today's news:

MySQL.com hacked using SQL injection; That site is running PHP/5.2.13.

So much for "not safe only for newbie users" argument.

share|improve this answer
5  
That's epic one. –  Tarik Nov 14 '11 at 18:23
1  
hahahaha The irony :))) –  Songo May 4 '12 at 17:48

I dont know that you can say with certainty that sites are targetted specifically because they are written in PHP. It may just be that the most popular open source web apps (phpbb, etc) are targetted, and they happen to be written in PHP.

That being said, earlier versions of PHP didnt support parameterized database queries, making it much simpler for someone to use SQL injection. Combine that with a lot of novices and webmasters who know just enough PHP to install an open source app, and you get yourself a lot of nice juicy targets.

share|improve this answer
3  
The language is not entirely blameless. Consider MongoDB, which was carefully designed to make injection attacks impossible. But PHP accidentally defeated that by being overly eager to parse data structures where none were intended. See idontplaydarts.com/2010/07/… for the details. –  btilly Mar 25 '11 at 20:44
3  
The language isnt blameless, which is why I DID NOT SAY IT WAS. My second paragraph specifically gave an example of PHP having a problem. What I did say was that I dont know if we can say for sure that PHP is specifically targetted, or if popular apps are targetted, and they happen to be written in PHP. Its not like apps written in other languages dont get exploited. –  GrandmasterB Mar 25 '11 at 20:57
1  
PHP did have db wrapper libraries even back in the PHP4 days that supported parametrized queries, but almost nobody used them. The biggest problem with PHP is that it does enough that people end up using it without any frameworks or wrapper libraries, yet fails to protect them from shooting their own foot. The database and mail functions are examples of api's that are so easy that everyone uses them, but for security reasons should really never be used "raw". –  Joeri Sebrechts Mar 28 '11 at 16:37

Because PHP

  • has a low entrance barrier, thus allowing unexperienced coders to quickly throw together a site, leaving a lot of security holes
  • suffers from many bad tutorials out there, which make the previous effect even worse
  • allowed/encouraged extremely insecure request processing
  • has had severe security issues, that allowed code injection
  • is widely spread, all the while most installations are outdated and thus provide a number of well documented security issues

So PHP itself is not insecure. Vast parts of the standard library (that are written in C) however have serious problems (not being binary safe, not properly handling over- and underflows, etc.).

If you keep your version up to date and programm carefully (or have a framework handle the sensible parts), you can make a site secure.

share|improve this answer
1  
you can make a site More secure, or secure to a point. –  Rory Alsop Mar 28 '11 at 10:58
    
@Rory Alsop: Since software should be measured in relation to its requirements and not on disputably absolute scales, 'secure' means 'as secure as required' and that is feasible with PHP. –  back2dos Mar 30 '11 at 10:55
    
I agree in principle, however there are a number of applications which could not be secured as required using php. I'm specifically thinking high value trading and transactional applications. I think it is more than appropriate for many other applications, however - I think your answer around low entrance barrier is spot on! –  Rory Alsop Mar 30 '11 at 11:34
    
@Rory Alsop: There is no reason, why you shouldn't be able to do something with PHP, if it is feasible with a mainstream alternative, especially, if you use a proper framework. –  back2dos Mar 30 '11 at 22:56

A language is only as secure as the ability of the programmer to employ security techniques. Much focus in the development of PHP is on reducing security risks. Unfortunately there are so many ways which hackers are able to get around different defenses that its very difficult for any language to be equipped (and for programmers to use those developments correctly) to prevent successful attacks all of the time.

The programmer is just as responsible for security risks if he/she doesn't adapt when risks are discovered. I think that can be expanded to say they're at fault if they're not actively looking for risks as well however this is sometimes difficult as projects don't tend to pay for that kind of up keep. So not only the language, but also the programmers, must adapt to thwart attacks.

Often times the language is upgraded much more often than the distributed installations are. There are still installations of PHP4 out there that I'm personally aware of (likely older versions are still around as well). It doesn't matter how secure a language is if you're using old versions.

All in all php is a secure language if used correctly (just as it is with any other language).

share|improve this answer
1  
Not true. There have been many exploits for vulnerabilities in the PHP itself. –  vartec Mar 26 '11 at 12:59
1  
@Kenneth: What does that prove? –  back2dos Mar 26 '11 at 17:57
1  
@Kenneth: If you think that you're "programming securely in PHP", that only proves that you never read security advisories for the software you're using. Which is poor security practice. It's like saying that you're just as safe in 15-years old Yugo as in new S-class, as long as you drive below speed limit. –  vartec Mar 26 '11 at 21:03
1  
@Kenneth: in which language security bugs are not found and fixed promptly? No matter how much you deny it, facts are simple -- PHP is not a secure language and never will be. –  vartec Mar 26 '11 at 21:52
1  
@vartec that is your opinion and you're welcome to it –  Kenneth Mar 26 '11 at 21:53

What the others have answered is fundamentally true: poor programming brings bad security, period.
But reputation is another thing; I think that much of PHP's bad reputation about security is the consequence of a long history of exploits of high-profile PHP applications with huge install bases, which is in turn the result of the great popularity of PHP.

share|improve this answer
    
care to explain the downvote? –  Agos May 9 at 21:22

I disagree with the argument "the only reason is the popularity with beginners", although that does have a big influence. The real reason for the bad reputation is in PHP's, and popular PHP software's, disregard for security in the past.

In the beginning PHP was not designed to be secure. You had for example GET/POST/Cookies imported as globals. No validation at all. Later on that was fixed, by adding directive for that, since few version by default off. Lack of validation was "fixed" by dirty hacks like magic_quotes_gpc. Also PHP's weird comparison semantics and type juggling didn't help much, many newbies would have code like if("secret_pass" == $_REQUEST['password']), which condition would be true if you pass 0 as password. That has been fixed by another dirty hack -- identity operator (===). As you look at history of PHP you'll see many similar examples of lack of consideration for security, which later are being patched by some dirty hack.

Another big blow to PHP security reputation came few years ago from popular software like phpBB or PHPNuke (and derivates). Both of which had terrible security record, having exploits like SQL injection or remote code execution. They have been target of few worms, thousands of sites were infected.

share|improve this answer
    
"secret_pass" == "0" evaluates to false for me. You cannot pass 0 in a $_REQUEST - the input data is not automatically parsed to integer types and so on. Not defending on PHP but this really sucks the credibility of your post down for me. –  Esailija May 14 '13 at 19:54
    
"secret_pass" == 0 does evaluate to true. If at some point PHP changed $_REQUEST not to auto-convert values, so be it. Yet another lame hack to prevent issue resulting from bad language design. –  vartec May 14 '13 at 20:18
    
Are you saying that PHP used to inspect the contents of every input to see if they can be parsed to more sophisticated types than strings? Doesn't sound very PHP to me :P –  Esailija May 14 '13 at 20:21
    
@Esailija: I'm saying that PHP used to interpret every "numeric string" as number and it still does in numerous contexts. And sometimes does funny things like '20110204024217300000' == '20110204024217300264', which on 32-bit system will return true –  vartec May 14 '13 at 20:25
    
btw. stackoverflow.com/questions/4100488/… –  vartec May 14 '13 at 20:26

Well I think most of it is bad propaganda, I do agree that PHP has a lot of flaws and need much reworking but it's not a zombie menace, look at projects like Magento and Wordpress.

I do think there's valid criticism, but the PHP hate is in a much more religious level, look at our major collaborator Vartec here, his argument is compelling and the CVE data is really impressive, but he failed to account semantics on the CVE website search engine.

We should all stop using HTML because well, we have 6346 vulnerabilities catalogued.

I mean, bible.php and BlackForest WP theme are core features that come with every PHP installation.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.