Protecting PHP Applications from Common Coding Mistakes and Risks

PHP has become the most popular application language on the web, but common security mistakes by developers are giving PHP a bad name. Here's how PHP coding errors have become the new low-hanging fruit for attackers, contributing to the phishing problems on the web. PHP became one of my favorite languages because of how quickly one can write a highly functional, standards-based web application with a database back-end. Unfortunately, attackers are taking these applications down even faster than they appear.

I'm sure I'll receive my share of flames under this column - but this is unfortunate, as I would hate to see such a nice language start to languish - however, for many folks there's no easier way to compromise a web server than to find a vulnerable application written in PHP. Let me start by saying that I'm a big fan of PHP and have written a number of web applications with it over the years. It's a great language that is now object-oriented, powerful and easy to learn, has a simple syntax, integrated SQL connectors, and high performance. It's simple to compile, very cross-platform, and has become arguably the dominant language on the web - thousands of commercial and open-source applications are available and in use.

The link for this article located at The Register is no longer available.