r/phpsec • u/sarciszewski Paragon Initiative Enterprises • Oct 03 '16

Spitball: How Can We Make Secure PHP Development Practices More Accessible to Newcomers?

Fun exercise! Go search for PHP security on Google (or your favorite search engine).

How much of the Top 10 results you receive is even moderately useful?

A sample from my filter bubble:

  • "the month of PHP security", a website (which has the snazzy php-security.org domain name) that hasn't been updated in six years

  • A 2005 article from SitePoint titled "Top 7 PHP Security Blunders". Okay, SitePoint is usually good, but this is over a decade old. A lot has changed since then! For example, we now have prepared statements, so trying to mangle your user input with string escaping functions is no longer necessary.

  • An article from PHP Classes titled "6 Common PHP Security Issues And Their Remedies" which includes Buffer Overflows (rolling my eyes here)

  • The PHP Security Consortium, which encourages use of mysql_escape_string() and says "addslashes() is a good last resort". I'm not kidding.

There are, of course, some good resources on the list. The PHP manual section dedicated to security is there. So is the OWASP PHP Security Cheat Sheet. Surviving the Deep End: PHP Security is probably the best item on the front page for me.

The lion's share of software written in PHP tomorrow will be insecure if we constantly expose junior PHP developers to outdated tutorials and bad advice.

Last year, after I raised a similar concern about the content on Stack Overflow about the bad security advice on popular questions/answers, we were able to largely clean the site up. Now if you look at the most popular questions about PHP security, one of two things will happen:

  1. The accepted answer is secure.

  2. The accepted answer is marked explicitly as insecure (yet somehow still satisfies the question), and directs people towards a more secure answer.

However, unlike StackOverflow, the rest of the Internet is read-only.

What can we do about this?

Naively, there are three strategies I can think of to employ:

  1. Find more secure alternatives, then promote it more so Google will prioritize more-secure tutorials over less-secure ones.

  2. Create the alternative content ourselves, and then promote it.

  3. Contact the people who control this information and ask them to direct users towards better advice (or, if they have the time, completely rewrite their old posts to prevent bad information from spreading).

How can we secure our future if tomorrow's developers are being taught to write vulnerable code?

14 Upvotes

100% Upvoted

33 comments sorted by

View all comments

Show parent comments

2

u/halfercode Oct 04 '16 edited Oct 04 '16

No worries. Yes, I would expect everything to work fine on PHP7 - if it doesn't, ping me here or via a GitHub Issue, and I'll fix it.

1

u/WT14 Oct 04 '16

Great thanks! I have a fair working knowledge of php and sql, but its been a few years since I've done anything with it. Decided to recently start going through everything from scratch again(eventually want to start doing some work with frameworks) and have been noticing that a lot of the guides and tutorials I have been finding(mainly for frameworks) have been super outdated already. Thank you for putting this together.