Safe PHP a Contradiction in Terms

[MetaWraith]

Whilst browsing I came across this recent article.
I wonder what the PHP users of this forum think ?

Safe PHP a Contradiction in Terms ?
http://www.viruslist.com/en/weblog?d...40463&return=1

So, the programmer who wrote the script made it include any file in the supplied parameter (local or remote) and hence execute it - basically allowing anyone to run anything on the server - anyone who does such a stupid thing should never be allowed near code near again.

[Graham M]

What an idiot... Almost as bad as

PHP Code:

<?php
system($_GET["command"]);
?>

or something along those lines

[Richard M]

What a load of BS.
ASP is more dangerous IMO (and in my experience) because "it just works" - just like those wireless routers that you can buy in the shops with the least secure settings already preset.

A proper programmer would know how to secure it.

That article is totally redundant.

[Stuart]

Just goes to show that ANY language can be dangerous..

[MetaWraith]

I guess you lot pass the test then.

The comments above are more or less what I expected,and mirror my own point of view that it was careless/negligent programming that resulted in the hack.

[Millay]

Any language is as dangereous it just depends on who codes it. ASP can be secure php can be secure if the coder does not know how to do this then its poor programming... IMHO

[philip.j.fry]

Originally Posted by Zeph

What an idiot... Almost as bad as

PHP Code:

<?php
system($_GET["command"]);
?>

or something along those lines

That's not bad per se because it can be an easy way for remote admin of a machine, it's just if you do use it you need to be sure of securing it.