Re: Is PHP a security risk?

> On 4 Jul 2000 13:00:34 -0700, azoldi@yahoo.com (Arpad Zoldi) wrote: > >> Hello, >> >> I have a question. >> I am creating a web-site which needs to access a >> Database and retrieve and display information. >> The alternatives on the server side for me where Java >> Servlets (and JSP) and PHP. <snip> >> Now, the web-hosting company has NT and IIS (this was >> not my choice). >> PHP works with IIS, so I thought this should not be a >> problem. I asked them to install PHP. The first answer >> was: What is PHP? >> >> I explained and sent them to the web-site and asked >> them, please, could you install PHP. >> The answer was: they don't support PHP due to security >> risks. Sorry, it doesn't help in your situation, but this made me smile. They are worried about security risks and they are running NT and IIS :) >> I think that is silly. I do not see PHP more a >> security risk than any other >> server-side script or interpreter. From their point of >> view, the only security problem which I could imagine >> is in the PHP interpreter itself, but that's a >> different story. In this case they don't trust the >> people who created PHP and it has to do with the >> open-source nature of PHP. Trust me, as an admin of an NT server, I didn't even blink when I installed php. IMHO it is perhaps the most secure piece of the system. The gaping holes in the user/privileges model of NT is a far, far worse security issue than php running as a CGI. As long as input is checked, I can see no reason to worry. >> The first thing that came to my mind was to send to >> them a list of big >> web-sites using PHP. But I could not find any really >> big names, only >> w3c.org (which is quite big I admit) but after a first >> glance I did not >> find any phpscripsts there. >> Anyone knows some well-known sites using PHP? >> >> All suggestions are welcome. >> Regards, >> Arpi Being flippant, find another ISP. Being slightly more helpful, check out http://www.php.net/sites.php for a list of sites using php. Some big names there... Regards -- Andy Warwick andy.w@creed.co.uk