I do this stuff as my day job, and so it is as factual as I can make it without breaking NDAs. I review nearly a hundred applications every year. Sometime, I find lots of stuff, others not so much. I’ve only done a few PHP reviews this year because our commercial customers stay away from it with good reason.

The first PHP review this year was so bad, the report weighed in at over 80 pages (most of our reports are in the 30-40 page mark). I know that the customer was unprepared for our findings, and in fact, as far as I’m aware, they’ve made no serious effort to fix the issues we identified.

It comes down to two things:

a) PHP is simple to use. So many people use it
b) the folks who are not CS majors do not even know what security is, and therefore the language designers have a responsibility to code to their primary audience. In PHP’s case, it’s hobbyist and first time programmers.

The skilled programmer like you and me: we don’t count. We are in the upper part of the bell curve. We can take care of ourselves regardless of how good or bad a language and its features are.

A good systems language is a balance between power and security. For example, it’s possible to write insecure Perl but there is SO much pressure to use things like taint mode and DBI’s prepared statements, that pretty much all the Perl I see is heavily standardized, heavily commented, and pretty secure. That’s one way a language which is heavily used in systems contexts, despite its many potential issues, is generally safe. Perl programmers are in my experience no better or worse than any other programmer.

PHP has no such pressure. After coding in PHP since 2002 and still fixing up code five years later, PHP has so much to learn from security folks it’s not funny.

Personally, although I applaud the decision to finally kill PHP 4, it’s far too late. PHP 4 will be on hosters until it becomes too expensive to host PHP any more from the sheer number of sites compromised. PHP 5 did not take off as fast as it should because it wasn’t backwards compatible. I STILL to this day cannot stop support for PHP 4, even though it’s got approximately 10 weeks to live.

I can’t guarantee MySQLi support, let alone PDO with MySQL support. I still don’t have guaranteed access to transactions. Therefore, I can’t leverage those technologies without writing three versions:

PHP 4 only, functional mysql
PHP 4/5, functional / OO hybrid using mysqli
PHP 5, OO mostly, functional a little, with PDO and transactions on InnoDB (maybe)

The last category, PHP 5 with PDO and with transactional support is such a tiny fraction of the PHP install base, that it is not worth writing to that platform. I would be better off writing a .NET on Mono as it nearly has as large an install base as PHP 5 with PDO and transactions.

PHP is a toy language used for non-toy functions. It needs to die as it CANNOT be made safe in its current form considering its core audience.

Andrew