From: Paul DuBois <paul@...>
Date: 2003-05-07T00:06:34+09:00
Subject: Re: Why is PHP so popular?  What can we learn from the PHP camp?

At 21:46 +0900 5/6/03, Andreas Schwarz wrote:
>Paul DuBois wrote:
>>  At 6:01 +0900 5/6/03, Andreas Schwarz wrote:
>>>Aredridel wrote:
>>>>   PHP was less designed than just kludged together.
>>>
>>>The language itself is VERY ugly, this doesn't need a discussion, and
>>>you could fill a book with the history of security problems in PHP.
>>
>>  That's an easy bandwagon to jump on, and (though you may be an exception),
>>  I'd guess that the majority of people who would be willing to throw out
>>  a remark like that couldn't name more than a couple of such exploits
>>  without looking them up.
>
>I'm not only talking about exploits like buffer overflows, but also
>about the concept of the language which makes (or made) it so easy to
>write 'dirty' and dangerous code (GET-Variables registered in global
>namespace etc.).

Could you explain this a bit more?  I'm not clear on why having a
variable be global makes it more of a security risk -- variables are not
shared between successive requests, after all.  Apparently the PHP
developers haven't considered making request variables global to be
in itself a problem, because they have made them, if anything, *more*
global through the introduction of the new superglobal arrays in
recent PHP releases.

Having request variables directly map onto script variables through
the register_globals directive *is* a security risk, because it allows
an attacker to set arbitrary variables in your script merely by naming
them on the request URL.  That's now disabled by default -- and it's
a different issue anyway.

>
>BTW: can mod_ruby be used on shared servers like mod_php?

I'm not sure why sharing a server would preclude use of mod_ruby...
so I believe the answer is yes.