Other programming languages popular on the web, such as Java and .NET, are used for banking sites. However, I've rarely (if ever) seen a PHP application designed to be deployed for a banking site.
Why is this? What about PHP is holding it back from this, or what about these other languages make them popular for secure transaction?
For banking sites or major transactional sites the risk management costs mean it is much easier and cheaper for a large corporate to feel confident with an application developed in .NET and uses the security framework provided with .NET than to use PHP.
At the end of the day organisations will use the cheapest environment they feel can provide the security they want based on their risk appetite, their threat profile and the size and type of development teams.
Developing a secure PHP application is likely to cost much more than a .NET application at enterprise level.
== in php returning true for quite different values. (That's why you should only use ===)
Commented
Sep 1, 2012 at 15:10
mysql_query with concatenated strings and no sanitization.
Commented
Sep 2, 2012 at 9:10
I've contracted as an IT consultant in four major UK banks, two UK financial trading services and one US bank and I've never come across a PHP based web system.
In my experience, 80% has been Windows/ASP and the rest Java. The current perception is that Microsoft and Oracle are professional, secure companies that can give support for mission critical systems running 24*7, while PHP and open-source is just used by students and hackers. I know this isn't the case (I also develop using PHP for eCommerce sites), but that's the perception. Also, MS and Oracle products integrate well with legacy bank mainframes, whereas PHP isn't so feature-rich in this area. Finally, we all love open-source because of it's low cost, whereas the banks aren't bothered about cost and will pay a premium to get a guaranteed support service (availability is more important to them that cost as it affects customer perception of their products).
Java pre-dates PHP by a pretty decent margin, and banks were some of the first institutions to start computerizing their infrastructure. So as a rule, most of them had a lot of stuff already in place, sometimes in Java, long before PHP even existed.
But that's not all. PHP is generally considered a web-only language. You can theoretically use it for other things, but it's a poor fit. Banks need a lot more code running their systems than just the web front-end. And since the vast majority of their code (and therefore their programmers) aren't using PHP, it doesn't make sense to use PHP for just the web front-end.
But that's not all either. Java and .NET aren't perfect and they've both had issues in the past. But when you compare their reputation against PHP, Java and .NET come out smelling like roses. Now PHP's reputation may not be deserved; there's a lot of really bad PHP programmers out there and a lot of really bad PHP code which isn't necessarily the fault of the language itself. Still, it's charitable to say PHP is a bit "quirky". And if you're looking for rock-solid secure and maintainable design, there's a strong argument to be made that PHP is not your best bet.
I'm Working in a french bank, boursorama.com. We have 3 similar banks in spain, UK & Deustchland. We use PHP for pretty everything except heavy load application (C & C++ instead). We have some Java proxy, provided by partners that don't have any other solutions.
I think PHP is not used by Bank Companies mostly because their technology stack is older than PHP5 himself. Before PHP5, you can't except getting out serious object oriented features.
From my experience, Bank don't have a single technology stack. They works with external partners through services that don't need to fit in your technologies (SOAP, REST, ...). So, all-in-all, you partners don't need to be involved in your tech choices.
PHP will surely be a serious competitor to the classical/professional languages like Java/C/.net in the future. Huge progress had been made in terms of standards and stability. And scripting languages tend to be faster than ever (look at javascript v8 performances).
In general, open source languages like PHP are rarely used in corporate environments, since people tend to associate value with price (that free things are also poor quality). I'd argue that this is the opposite of reality in the programming world, but I'm not in charge of any banks.
As for PHP specifically -- it's extremely difficult to write an application in PHP without running into one of its major flaws. Anyone serious about security is unlikely to use it (which unfortunately creates a vicious cycle, where none of the major PHP developers knows anything about security). For example, there are a large number of wrong ways to escape a string for a database (including ones that look right), and hardly anyone uses the safest way. Or how the only correct way to hash passwords in PHP was only added recently and is still hard to use (and the fact that the default is incredibly insecure).
This is not true, PHP is widely used for banking transaction. However it's rare for banking sites, because banks can afford expensive IDEs like Visual studio, so they prefer it instead. Also dedicated servers. You can bypass security on both java and c# as well PHP, you can secure both to the same level as well. It has to do also with database. SQL Server works with C#, for Oracle Java is used. Such database is used for security reasons as well replication, which is not available (until recently) in LAMP stack.
