Paul, Beth and Sean struggle to find relevant news. Summer is slow, but fortunately, our PHP-friends Derick Rethans and Ed Finkler helped us out. Big thanks to them for saving the day.

You can grab this latest episode off of their feed or just download it directly from the site.

Our special guest today is Ed Finkler. Ed is a web application developer, security expert, graphic designer, and dabbling musician. He works for CERIAS at Purdue University, and is a member of the PHP Security Consortium. Today Ed is going to give us the lowdown on the PHP based framework, CodeIgniter.

You can download this episode directly here or just subscribe to the podcast feed to get all of the past and future episodes of these quick doses of PHP wisdom.

Ed Finkler agrees with me. Thanks Ed. :-) Listen to the podcast. It's a realistic assessment of the state of security in PHP.

He also includes a favorite quote from the podcast (as said by Ed):

If web developer doesn't understand common security issues they shouldn't be considered developers...[Web applications] essentially are dealing with data that someone is inputting there. As a developer of web applications, you are essentially stewards of that data.

Today I learned about a podcast interview of Ed Finkler one of the members of the PHP Security Consortium. I heard through the first 30 minutes and was kinda bored because it was not really about PHP Security but about educating PHP developers, which is a subtopic of PHP Application Security which itself is a subtopic of PHP Security. I already wanted to switch it off when at around 34:32 they started talking about the Month of PHP Bugs.

Stefan also notes that Ed didn't mention that several of the MoPB issues had already been released to the PHP group but had yet to of been corrected. Be sure to check out the podcast for yourself, though and see what you think of Ed's comments about PHP security and the MoPB initiative.

Ed Finkler is also a primary developer on the PHPSecInfo project, an effort to help bring a baseline of security to developers and their applications:

PhpSecInfo provides an equivalent to the phpinfo() function that reports security information about the PHP environment, and offers suggestions for improvement. It is not a replacement for secure development techniques, and does not do any kind of code or app auditing, but can be a useful tool in a multilayered security approach.

Check out some of Ed's own comments about the interview in this new blog entry.