Technology

59374 readers

7113 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

How is the security level of PHP in 2023? (lemm.ee)

submitted 1 year ago* (last edited 1 year ago) by [email protected] to c/[email protected]

23 comments fedilink hide all child comments

In the early 2000s, everyone in my bubble knew that PHP was a security nightmare, only seconded by Flash. In the meantime, Adobe gave up on Flash, but PHP is still alive and rocking.

How did that happen? Did PHP get some serious makeover? Do developers just not care?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 8 points 1 year ago (1 children)

PHP makes up like 80% of all websites worldwide.

I must is missed the security concerns, I didn't start programming in PHP until 2003.

[–] [email protected] 11 points 1 year ago* (last edited 1 year ago)

PHP makes up like 80% of all websites worldwide.

That statistic is ridiculous and I wish people would stop quoting it because it's not doing anybody any favors. In particular it completely discredits PHP from any chance of claiming some reasonable numbers.

The survey's methodology is full of holes and biases and completely fails to account for all kinds of factors, such as the fact that most websites out there don't have "powered by" headers (it's not a thing for most of the languages they claim to have detected; and how do you detect "static files"?), or that modern cloud infrastructure is distributed and cannot be evaluated like the monolithic on-premise servers of decades ago.

If you're still not convinced I give you two things to consider:

Take a large site that you know for a fact is powered by PHP, like wordpress.com or any of the blogs hosted by them, and look at the HTTP headers. They don't say anything about PHP.
Look at the rest of the survey results. They say Ruby is more widely used than Java and Node. That Scala is more widely used than Python. That Coldfusion and Erlang are in the top ten of web server technologies. None of it makes any sense.