Exploiting Common Vulnerabilities in PHP Applications
PHP has the following characteristics:
- Fast Execution - The interpreter is embedded in the web server, no fork() or setup overhead
- Feature Rich - Hundreds of non trivial builtin functions
- Simple Syntax - Non declared and loosely typed variables, 'wordy' function names
Over the course of this paper I'm going to try to explain why I feel the last two characteristics make applications written in PHP easy to attack and hard to defend. Then I'll finish off with a rant about distribution of 'blame' when it comes to software security.
[ Read more ]
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.