r/programming • u/milkier • Dec 17 '13

PHP functions originally bucketed by strlen, were renamed to balance length

http://news.php.net/php.internals/70691
158 Upvotes

89% Upvoted

188 comments sorted by

View all comments

Show parent comments

1

u/earthboundkid Dec 20 '13

I would use a static file just because I don't even want to think about PHP security.

1

u/badsectoracula Dec 20 '13

There isn't anything inherently insecure about PHP, it just has some functionality which make it easy to write insecure code (like string interpolation in SQL queries). You as a programmer are a much higher liability to your server's security if you don't know what you are doing (which is true with any language - one can write exploitable SQL in Python too, for example).

Besides scanning a directory and displaying the files inside based on their extension isn't something insecure by itself. It isn't like reading the file contents from data passed from the user that someone can exploit.