After yet another exploit of and malware injection into his website, host Leo Laporte of the Twit network has recently asserted/been told by his security expert that falling victim to such attacks is simply the cost of doing business on the Internet, and that the best one could do about it is to react quickly, remove the malware and fix whatever exploit was used, if possible. The biggest blame for this was laid at the feet of PHP, which is "inherently insecure" with its execute-files-in-any-folder architecture.
This assertion simply blew my mind. Is this the best advice a security expert can offer? While it's certainly true that PHP isn't exactly the tightest language out there, and that there are almost inevitably exploits somewhere, especially if you use a lot of drop-in, pre-fab packages, the biggest blame should still be laid on incompetent programmers and server administrators. No?
Is it really an insurmountable task for a security conscious developer who knows what he's doing to develop an exploit-free moderately complex website in a reasonable amount of time? While I'm sure that the systems I have developed aren't 100% bug free, I do take great care with anything that may enable an attacker to modify my server in any way; and so far I have not had to deal with malware injection. Is the state of web development really such that the only solution to code injection is to constantly clean up after the bad guys? Is there any real-world data on this issue?