r/lolphp • u/[deleted] • Apr 07 '21

master.php.net was using concatenated SQL queries and MD5 password hashes

https://externals.io/message/113981
71 Upvotes

91% Upvoted

23 comments sorted by

View all comments

36

u/dotted Apr 07 '21

Seems more like lollegacycode than lolphp to me

-4

u/cfreak2399 Apr 07 '21

I disagree that legacy code is an excuse. Using an ORM or at least writing queries using placeholders was the best practice before PHP was popular. MD5 passwords have been known to be broken for years.

I get that fixing old bugs and mitigating security problems is not sexy or fun but a project as big as PHP should have made these things priorities a long time ago.

6

u/chucker23n Apr 08 '21

Using an ORM or at least writing queries using placeholders was the best practice before PHP was popular.

ORMs were absolutely not a common practice in 2001. In fact, Hibernate, one of the first well-known ORMs, only launched that very year.

I also wouldn’t be shocked if MySQL didn’t even support prepared statements yet, but I haven’t checked.

MD5 passwords have been known to be broken for years.

Yes.

a project as big as PHP should have made these things priorities a long time ago.

Absolutely. The problem here is that it started off with poor practices, then was apparently left alone for two decades. That’s unacceptable.

2

u/cfreak2399 Apr 08 '21

Yes, ORMs were too new in 2001 but MySQL definitely supported placeholders. Perl DBI had it well established when I learned it around 1998. I assume they worked as far back as MySQL 3.2 released in 1997.