Re: Security Question

On Mon, Oct 27, 2008 at 19:56, Jeremy Seibert <jdseibe@gmail.com> wrote: > * Hi, > > Im contacting you because I have a question, at my old job i developed > scripts using PHP, I started at my new job and they don't have PHP installed > on our servers, I asked why and they copied and pasted this snippit out of > their refrence manuals. > > my question is, is what they say about PHP true? about how it requires CGI > to be activated? because I want to fight this issue and was hoping that it > wasn't true, and I figure what better source to prove them wrong than from > php.net. they don't want php installed on their server because they think > its some sort of security issue. > > > "Because of the inherent security risks associated with common gateway > interface (CGI) modules, (Company Name) does not allow CGI in the shared > hosting environment. The stated direction for CGI is to convert all related > code to another supported programming environment such as Java. If CGI > support is an absolute requirement, then the system must reside on either a > deviation server, dedicated server, or a dedicated zone. Additionally, an > approval to use CGI must be obtained from (Company Name)'s IS&S Security. > Note that this restriction applies to all languages which would require CGI > to be activated for use with the web server, including: Perl, PHP, and > Python." Thats an awesome snippet. Hope you don't mind me pasting it to friends? :) PHP does not require CGI anyway (and was in fact not the recommended way). -Hannes