Quote:
darkecho originally posted:
That's a terrible way to put it. For someone who seems new to this area, I can seen the interpretation meaning "I don't have to worry about security" when in fact, one should always be worried about security. I run across scripts on a daily basis that rely on register_globals and don't use mysql_real_escape_string, and these are custom coded sites that "professionals" made.
|
Yes, that's an important point. I'd like to emphasize that PHP (and ASP, which is probably the only alternative) are
languages. That means that
you are coding the software, not PHP or ASP. It is
your duty to ensure that your code doesn't have any loopholes through which any sort of attack can take place. The languages can only (and do) provide tools to help you ensure that your site is safe. You have to use them. In that way, ASP and PHP both provide these tools and are "safe". That does
not mean your site can never be attacked.
Linear Mode
