Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 7 down vote favorite
3

Other programming languages popular on the web, such as Java and .NET, are used for banking sites. However, I've rarely (if ever) seen a PHP application designed to be deployed for a banking site.

Why is this? What about PHP is holding it back from this, or what about these other languages make them popular for secure transaction?

share|improve this question

5 Answers

up vote 9 down vote

For banking sites or major transactional sites the risk management costs mean it is much easier and cheaper for a large corporate to feel confident with an application developed in .NET and uses the security framework provided with .NET than to use PHP.

At the end of the day organisations will use the cheapest environment they feel can provide the security they want based on their risk appetite, their threat profile and the size and type of development teams.

Developing a secure PHP application is likely to cost much more than a .NET application at enterprise level.

share|improve this answer
4  
what features of php makes costlier than .net for bank applications? – Harshal Mahajan Sep 1 '12 at 15:00
1  
@andrew ,can you listed few of them? – Harshal Mahajan Sep 1 '12 at 15:07
3  
The weak typing in php is a bit annoying. Makes it much easier to make subtle validation or type conversion mistakes. One classical example is == in php returning true for quite different values. (That's why you should only use ===) – CodesInChaos Sep 1 '12 at 15:10
2  
@HarshalMahajan, there's been a lot written on the net about shortcomings of PHP; you can spend an afternoon web searching and reading. Some samples: PHP: a fractal of bad design; also, In which I write about PHP for the first and the last time; also, I’m sorry, but PHP sucks., and so on. – D.W. Sep 1 '12 at 20:01
1  
@D.W. Whilst I somewhat agree with the points made in there, the fact is that PHP makes it very easy to write code, and it scales incredibly well. If you use a proper framework design (MVC-style) it can be really maintainable too. Once you get past its quirks and strangeness, it's actually a great language. However, its biggest failure is not really its own fault - tutorials (W3Schools being the obvious example) have a horrendous track record for teaching awful security practices, e.g. mysql_query with concatenated strings and no sanitization. – Polynomial Sep 2 '12 at 9:10
show 10 more comments
up vote 3 down vote

I've contracted as an IT consultant in four major UK banks, two UK financial trading services and one US bank and I've never come across a PHP based web system.

In my experience, 80% has been Windows/ASP and the rest Java. The current perception is that Microsoft and Oracle are professional, secure companies that can give support for mission critical systems running 24*7, while PHP and open-source is just used by students and hackers. I know this isn't the case (I also develop using PHP for eCommerce sites), but that's the perception. Also, MS and Oracle products integrate well with legacy bank mainframes, whereas PHP isn't so feature-rich in this area. Finally, we all love open-source because of it's low cost, whereas the banks aren't bothered about cost and will pay a premium to get a guaranteed support service (availability is more important to them that cost as it affects customer perception of their products).

share|improve this answer
up vote 1 down vote

In general, open source languages like PHP are rarely used in corporate environments, since people tend to associate value with price (that free things are also poor quality). I'd argue that this is the opposite of reality in the programming world, but I'm not in charge of any banks.

As for PHP specifically -- it's extremely difficult to write an application in PHP without running into one of its major flaws. Anyone serious about security is unlikely to use it (which unfortunately creates a vicious cycle, where none of the major PHP developers knows anything about security). For example, there are a large number of wrong ways to escape a string for a database (including ones that look right), and hardly anyone uses the safest way. Or how the only correct way to hash passwords in PHP was only added recently and is still hard to use (and the fact that the default is incredibly insecure).

share|improve this answer
up vote 1 down vote

Java pre-dates PHP by a pretty decent margin, and banks were some of the first institutions to start computerizing their infrastructure. So as a rule, most of them had a lot of stuff already in place, sometimes in Java, long before PHP even existed.

But that's not all. PHP is generally considered a web-only language. You can theoretically use it for other things, but it's a poor fit. Banks need a lot more code running their systems than just the web front-end. And since the vast majority of their code (and therefore their programmers) aren't using PHP, it doesn't make sense to use PHP for just the web front-end.

But that's not all either. Java and .NET aren't perfect and they've both had issues in the past. But when you compare their reputation against PHP, Java and .NET come out smelling like roses. Now PHP's reputation may not be deserved; there's a lot of really bad PHP programmers out there and a lot of really bad PHP code which isn't necessarily the fault of the language itself. Still, it's charitable to say PHP is a bit "quirky". And if you're looking for rock-solid secure and maintainable design, there's a strong argument to be made that PHP is not your best bet.

share|improve this answer
up vote -4 down vote

This is not true, PHP is widely used for banking transaction. However it's rare for banking sites, because banks can afford expensive IDEs like Visual studio, so they prefer it instead. Also dedicated servers. You can bypass security on both java and c# as well PHP, you can secure both to the same level as well. It has to do also with database. SQL Server works with C#, for Oracle Java is used. Such database is used for security reasons as well replication, which is not available (until recently) in LAMP stack.

share|improve this answer
Thanks for answer andrew,but the problem with the my MySQL database ? instead they are using oracle like costly databases? – Harshal Mahajan Sep 1 '12 at 14:55
SQL database must support per-row security and user authentication using cryptography to make banking transactions. Open Source databases do not have it yet. Oracle is not really that expensive either, if you consider it's features. – Andrew Smith Sep 1 '12 at 14:56
3  
@HarshalMahajan Encryption is not security. Please don't confuse the two. For example, I might encrypt my data with AES256, using a key derived using PBKDF2, with a perfectly random IV, then put the password on a sticky-note and attach it to my computer. The crypto is strong, the security is weak. There's a huge difference. – Polynomial Sep 2 '12 at 9:06
1  
Java and SQL server, or C# and Oracle are used often. The database is (or at least should be) irrelevant to the development language. – iivel Sep 21 '12 at 16:10
3  
" PHP is widely used for banking transaction." - Are there any examples of this? I haven't even seen one so far. – tylerl Sep 23 '12 at 8:03
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.