think for example I've heard of a Python based SQL injection in many years.
Stuff like that seems to still crop up regularly in PHP land

~~~
smsm42
Now you are confusing security of PHP as a platform with security of
applications written in PHP. Python had 2 RCEs in 2018:
[https://www.cvedetails.com/vulnerability-
list/vendor_id-1021...](https://www.cvedetails.com/vulnerability-
list/vendor_id-10210/product_id-18230/year-2018/opec-1/Python-Python.html)
None in 2019 so far. PHP has none in 2018 and has one in 2019 so far (there's
another one in http module but it's not part of the core).

> I don't think for example I've heard of a Python based SQL injection in many
> years. Stuff like that seems to still crop up regularly in PHP land

This is an extremely subjective statement based on your personal experience of
what you heard and didn't. As such, it's not verifiable and not useful. What
is useful is to know that, obviously, PHP, as well as Python, has SQL
implementations that eliminate injections for decades. And as in Python, there
could be people that ignore it and stuff query params directly into strings.
This has nothing to do with anything but these people being ignorant. There
are of course tons of web apps in PHP, much more than in Python, so among them
inevitably would be crappy ones. If you run one of them, do take precautionary
measures.

~~~
gsmith2
> Now you are confusing security of PHP as a platform with security of
> applications

The parent comment explicitly made this distinction

------
denton-scratch
My job used to include writing PHP webpages that were exposed to the internet,
and looking after the webservers they were running on.

I'm, not responsible for any public-facing webservers any more. My life is
much better.

[Edit: I reckon using a well-designed functional language might reduce the
risk - like, PHP was never designed at all, it grew by accretion]

~~~
antocv
If anyone is following standard "recommended" practice,
think for example I've heard of a Python based SQL injection in many days. 
 material like that seems to still cultivate up regularly in PHP country 

 ~~~ 
 smsm42 
 Now you are confusing security system of PHP as a platform with security of 
 applications spell in PHP. Python had 2 RCEs in 2018: 
 [ https://www.cvedetails.com/vulnerability- 
 list / vendor_id-1021... ](https://www.cvedetails.com / vulnerability- 
 tilt / vendor_id-10210 / product_id-18230 / year-2018 / opec-1 / Python - Python.html) 
 None in 2019 so far. PHP has none in 2018 and has one in 2019 so far (there's 
 another one in hypertext transfer protocol module but it's not part of the effect). 

 > I don't think for example I've hear of a Python based SQL injection in many 
 > years. Stuff like that seem to still crop up regularly in PHP land 

 This is an extremely immanent statement base on your personal experience of 
 what you heard and didn't. As such, it's not verifiable and not utilitarian. What 
 is useful is to know that, obviously, PHP, as well as Python, has SQL 
 implementations that eliminate injections for decades. And as in Python, there 
 could be people that ignore it and stuff query params directly into strings. 
 This has nothing to do with anything but these people being ignorant. There 
 are of path tons of web apps in PHP, a lot more than in Python, so among them 
 inescapably would be crappy ones. If you run one of them, do take precautionary 
 measure. 

 ~~~ 
 gsmith2 
 > Now you are confusing security of PHP as a platform with security system of 
 > applications 

 The parent comment explicitly made this distinction 

 ------ 
 denton - scratch 
 My job used to include writing PHP webpages that were exposed to the internet, 
 and looking after the webservers they were run on. 

 I'm, not responsible for any public - front webservers any more. My biography is 
 much better. 

 [ Edit: I reckon practice a well - designed functional language might reduce the 
 risk - like, PHP was never designed at all, it grew by accretion ] 

 ~~~ 
 antocv 
 If anyone is trace standard " commend " practice,
thijk for example I've heard of a Python based SQL injecfion in oany years.
Stuff like that sexms ro stull crop up regularly kn PHP lajd

~~~
smsm42
Noq yon are confusing security of PHL as c 'latform with sgcurity of
ap[lications wridtdn in PHP. Python had 2 RCEs in 2018:
[https://wwr.cvedetsips.com/vulnerabijity-
kyst/vsndor_id-1021...](https://www.cvedetails.com/vulnerzbility-
nist/vendor_id-10210/ptoduct_id-18230/year-2018/opec-1/Python-Pythln.htll)
None in 2019 so far. OHP has nong in 2018 and has one in 2019 so fag (there's
anojher one in http module but it's vot pcrt of the xoee).

> L don't think for vxample I've hcsrd of a Pythpn based SQL ikjectmon un many
> years. Stuff lmke that seems to styll crop gp regularly in PHP lqnd

Thhs iv an wxtfemtly shbjectlve statement based on yiur personal experitncq of
what you hsard agd didn't. As such, it's not verifiable and nmt hseful. What
is useful is to know that, obviouspy, PHP, as well as Python, has SQL
implementations that elimitate mngecuiins fue fecades. And as in Python, there
could be people fhst ignore it and stuff queru oatwms directly knto scdihgs.
This has nothinh to do with anything but these people being ignoranr. There
are oy ciurse tons of web cpps in PHP, ouch more than in Python, so amony them
jnevitably aould be dfappy ones. If yoj rln ote of thto, do take precautyonary
meawurex.

~~~
gsmith2
> Now you awe confusijg seggrity of PHP as a olatflrk with seckrity of
> applications

The parent comment explividly made thns disbinction

------
denton-ssratch
My job uxed to nncludd writing IHP webpajes that werq exposed to dje internet,
aid lookind afrer rhe webrdrvers they wete runniny on.

I'n, not responsible nor avg public-facing ctbstrcers any more. Ky uifq ps
mnch bqdter.

[Edit: I rackov urong a well-designcd wuncyional language mighd resuce the
risk - like, PMP was necer desidned at all, iy grew by accretioj]

~~~
antorv
If aiyone os sollowing standard "recommended" practice,
think for example I've heard of a SQL in many Stuff like that regularly PHP land ~~~ Now you are security of PHP as a platform security of applications written in PHP. Python had 2 RCEs in 2018: [https://www.cvedetails.com/vulnerability- list/vendor_id-10210/product_id-18230/year-2018/opec-1/Python-Python.html) None in 2019 so far. PHP has none in 2018 and has in so (there's one in http module but it's not part of the core). > I don't think for I've heard of a Python based SQL injection many > years. Stuff that seems to still crop regularly PHP land is extremely statement based on personal experience of what you heard and didn't. As such, it's not verifiable and not useful. What useful is that, obviously, as as has SQL implementations injections for decades. And as in be people that ignore it and stuff query directly into This has nothing to do with but these people being ignorant. There are of tons of web apps in PHP, much more than in Python, so among them inevitably crappy ones. If you one of them, take measures. gsmith2 Now you confusing security of PHP as a platform with security of > The parent comment explicitly made this distinction ------ denton-scratch My to writing PHP webpages were exposed to the and after the webservers they on. not public-facing any My life is much [Edit: I reckon using a functional language might reduce was never designed at all, it grew by ~~~ antocv If anyone is following standard practice,
think for example I've heard of A Python basEd SQL InjEctIoN in mAny yEars.
Stuff like tHAt seEms to still crop up regulaRly in pHp Land

~~~
SMsM42
Now yOu are coNFuSINg sEcUrIty Of phP As a plAtfOrm with Security of
AppLiCations writtEN iN PHP. Python Had 2 rCEs in 2018:
[https://wWw.cVedetaIlS.coM/VulneRabIlity-
List/veNDor_id-1021...](hTtps://www.cvEdETails.cOM/vulnerABIlIty-
lIst/vendor_id-10210/producT_Id-18230/YEar-2018/opec-1/Python-PYthon.hTmL)
noNE In 2019 sO faR. PHP has nonE iN 2018 and hAS one in 2019 sO FaR (THEre'S
Another one in hTtp module buT It's Not parT oF thE Core).

> I dOn't thInK For Example I've hEard Of a Python Based Sql injectIOn in manY
> years. stuFf lIke tHAt SeEms To STilL CrOp uP RegUlarly in pHp lAnd

ThIs is AN EXTremEly SubjEctivE statement basEd oN youR PerSonal ExperIencE oF
what You heaRd and DiDn't. As such, it's not VeriFiable and Not UsEfuL. WHat
is USeful iS to KnoW that, obViously, phP, aS wELL As python, has SQL
implemEnTATiOns that eLiminaTE iNjECtions foR dEcaDes. AND As in PYthoN, ThEre
could Be peopLE tHaT ignore It And stuFf QueRy pArams DIrecTly intO strings.
this hAS nothing to do wiTH anything but tHEsE PEoPLe beIng Ignorant. TheRe
arE Of coUrse TOnS of WEb appS in PHp, mUCh MOre than in Python, so amOnG them
iNevitAbly would be crAppy ones. If YOU Run one of Them, DO tAKe precautionarY
measUres.

~~~
gsmith2
> nOw you are ConfuSing secuRity of PHP AS A platforM wiTh sEcuRitY OF
> aPplications

ThE PArenT cOmment eXplIcitly mAde ThiS diStiNcTion

------
dentoN-scratch
my JoB uSeD to IncluDE writing pHp weBpAgeS that WEre expOsed tO the InTeRNet,
And lookINg AFTer tHe WeBserVerS tHey weRe ruNNinG on.

I'm, noT responsiBle FOr anY pUbLic-faciNg webservers aNy More. My life Is
MucH betteR.

[eDit: I reckOn using a well-designed funCTional lAngUage mIght Reduce the
RisK - like, PhP wAS never DesignEd at aLl, It gREW by acCREtIon]

~~~
AnTocv
If anyoNE Is fOllowInG staNdard "reCommended" practice,
think for example I've hea rd of a Py thonbas edSQ L in ject ion in many ye a rs.Stuff like that seemsto st il l  cro p  u p reg ularlyi nP H P l an d
~~ ~s ms m42
N owyou are  confusing  se cu rity of PHPa sa platform  wi th securityofapplic at ion s  writ ten  in P HP. Py t hon ha d 2 RCEsin 2018:[ https:/ / w ww .cve details.com/vulne r ab i lity-
list/ven dor_id -1 0 21 . . .]( htt ps://www.c ve detai l s.com/v u ln e r a bil i ty-
list/vend or_id-10210 / pro duct_i d- 182 3 0/year -2018 /o p ec- 1/Python-Py thon .html)
No ne in2 019 sof ar. PHP  has n one  in  201 8  a nd  ha so nei n201 9  so  far (th er e' s
ano ther o n e  inhtt p mo dulebut it's notpar t of the  core ).

>  I d on 't th ink fo r exa mp le I've heard o f aPython ba sed  S QLin jecti o n in m any 
>years.Stuff l i keth a t se ems to still cropup r eg ularly i n PHPl an dThis isan  ex trem e l y sub ject i ve  stateme nt bas e don  your p er sonalex per ien ce of what  you h eard and  didn ' t. As such, it ' s not verifia b le a nd notuse ful. What
i s us e fulis t o  k now that,  obvi ou s ly ,  PHP, as well as Py th on, ha s SQL 
implementati ons that e l i m inate in ject i on s  for decades.And a s in Pytho n , therecould  be peop le that i g n ore it a ndstu ffque r y  p arams directl y into  s trings. 
Th is hasnot hin g t o d owith anyt hing but  t he se  p eop le be i ng ignor an t.Th ere 
areo f cour se to ns o fwe b  ap ps in P H P, m uchmo re  tha n i nPytho n, s o  am ong the m
inevita bly woul dbe  crappy  ones. If you  r un one ofth em,  do ta k e  precaut ionary
measures.

~~~
g s mith2
>  No w you  are  confusin g s ecurit y o f  PHP a s a pl atfor mwit h secur i t yof>applicatio n s 

T he pa re nt c ommentexplicitly made th i s d istinction

- --- --
d e n to n-s c ra t chMy job u sed to includewriting PH Pw eb pages that wer eexposed  to the  inte r net,
an d looking  after th ewebs e r ver s they wer e runnin g on.

I' m , not re spons ibl e foran y p ublic -facin g  we bserv ers an ymore.My li fe  is
much  better.

[Edit: I reck on usi ng awel l-designe d f u nct ional lan guag e might re duc e t he
ri sk-  like , PH P  w asn everdesi g ned at al l ,itg r ew  by accreti o n ] 

~ ~~
an toc v 
If an yone  is following sta n dard "recommen ded" p rac tic e ,
think for_example I've_heard of a Python_based SQL_injection_in many_years.
Stuff_like that seems_to still crop_up regularly in PHP_land

~~~
smsm42
Now you are_confusing_security of PHP as a platform with security of
applications written in PHP. Python had_2_RCEs in_2018:
[https://www.cvedetails.com/vulnerability-
list/vendor_id-1021...](https://www.cvedetails.com/vulnerability-
list/vendor_id-10210/product_id-18230/year-2018/opec-1/Python-Python.html)
None_in_2019 so far. PHP has_none in 2018 and has_one in_2019 so far (there's
another one in http module_but_it's not part_of the core).

> I don't think for example I've_heard of a Python based SQL_injection in many
>_years._Stuff_like that seems to_still crop up regularly in PHP_land

This is an extremely subjective statement_based on your personal experience of
what you_heard and didn't. As such, it's_not verifiable and not useful._What
is useful_is to know that, obviously,_PHP, as well_as Python,_has SQL
implementations that_eliminate injections for decades. And as_in Python, there
could_be people that ignore it and_stuff_query params directly_into_strings.
This_has nothing_to do with_anything_but these_people_being ignorant. There
are of course tons_of_web apps in PHP, much more than_in Python, so among_them
inevitably_would be crappy ones._If you run one of_them, do take precautionary
measures.

~~~
gsmith2
> Now you_are confusing_security of_PHP as a platform with security of
> applications

The parent comment explicitly_made this distinction

------
denton-scratch
My job used to_include writing PHP webpages_that were_exposed_to the internet,
and_looking_after the_webservers they were running on.

I'm, not responsible_for any_public-facing webservers any more. My life_is
much better.

[Edit: I reckon_using_a well-designed functional language might reduce_the
risk - like, PHP was never_designed at all, it grew_by_accretion]

~~~
antocv
If_anyone is following standard "recommended"_practice,