Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been told that generally speaking, asp.net web apps tend to be more secure than php, since asp.net has some automatic security measures, for example, by default it doesn't allow remote file inclusions. And when you code in php, you have to take care of those things yourself, so some developers might forget to do that. So my question is, generally speaking, are asp.net web applications more secure than php web apps?

share|improve this question

closed as not constructive by Terry Chia, AviD Mar 12 '13 at 13:29

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
The problem with php isn't remote file inclusion on similar features. It's the broken type system. –  CodesInChaos Mar 12 '13 at 13:23
1  
    
@CodesInChaos what do you mean exactly about broken type system? –  Salvador Dali Mar 12 '13 at 17:10
    
@SalvadorDali For example all those nonsensical implicit conversions, ignoring type mismatches(sometimes outputting a warning), etc. –  CodesInChaos Mar 12 '13 at 20:18
    
@CodesInChaos I think that perl, have similar implicit conversion, and there is nothing wrong with this. –  Salvador Dali Mar 12 '13 at 22:29

1 Answer 1

ASP.NET will be more secure than PHP if the developer masters ASP.NET more than PHP. And vice versa.

There are many claims that a lot of features of PHP seem to have been designed by a lemur who had taken acid, leading to a rather tortuous set of features and thus potentially making the task of developing securely rather harder than what it could have otherwise been. However, these details are dwarfed by the skills of developers, or lack thereof. Regardless of the language details, the developer must think of "what could go wrong with the code" and there is no automatic tool which will do the thinking for him.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.