In a new post to his blog today, Dan Scott points out an article over on the Linux Weekly website talking about the current state of PHP security.

I was hoping for some provocative thoughts about the direction that PHP has been taking for the last six months or so in the arena of security. Unfortunately, I was greatly disappointed. Beyond using Stefan's departure as a kicking-off point for the article, the author didn't even mention any of these issues (taint, ext/filter, etc).

Instead, the article swerves back into the old rut of register_globals and magic_quotes. Dan also expresses concern at a possible misquote from Rasmus Lerdorf and that, had the author done a bit more homework, they wouldn't have made comments (in reference to the above mentioned features) like:

Security is a hard problem and any attempt to 'dumb down' a language is likely to run into security issues. [...] A great deal of useful code has been written on the PHP platform; it would be nice to find a way to keep that code coming while simultaneously making it more secure.

In a new post to his blog today, Dan Scott points out an article over on the Linux Weekly website talking about the current state of PHP security.

I was hoping for some provocative thoughts about the direction that PHP has been taking for the last six months or so in the arena of security. Unfortunately, I was greatly disappointed. Beyond using Stefan's departure as a kicking-off point for the article, the author didn't even mention any of these issues (taint, ext/filter, etc).

Instead, the article swerves back into the old rut of register_globals and magic_quotes. Dan also expresses concern at a possible misquote from Rasmus Lerdorf and that, had the author done a bit more homework, they wouldn't have made comments (in reference to the above mentioned features) like:

Security is a hard problem and any attempt to 'dumb down' a language is likely to run into security issues. [...] A great deal of useful code has been written on the PHP platform; it would be nice to find a way to keep that code coming while simultaneously making it more secure.