4

I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP?

Since it's serverside it shouldn't have access to the visitor's computer.

Improve this question

2 Answers 2

Reset to default
12

PHP runs on the server; it is code which ultimately produces a Web page to be returned to the client. From the client point of view, only the received bytes matter, not how they were computed on the server; it makes no difference whatsoever to the client if the Web page was dynamically generated with PHP or Java or whatever, or if it was the contents of a statically served file.

So there is no specific "PHP powered" client infection which can take place, and which would not have been equally infectious if done server-side with any other technology.

Of course, mere rational thinking should not prevent anybody from laying blame. When the Black Death scourged Europe in medieval times, it was (probably) due to a pathogen agent relayed by fleas who were carried by rats; so the rats were not really responsible, being at worst second-level indirect accomplices. Yet they took the full force of the blame.

Similarly, while PHP is by no means responsible for client infection, incautiously written PHP server code can make servers vulnerable to hostile takeover, which can result in turning them into vectors of infection for clients (using one of the myriad security holes in client browsers). So it is possible to say, with only the minutest dose of unfairness, that PHP can be considered somewhat harmful to clients.

Improve this answer
4
  • 4
    +1 for comparing PHP to rats as an indirect plague vector!
    – bstpierre
    Commented Jan 16, 2012 at 21:07
  • 1
    The fact that the server code may be written in PHP has absolutely nothing to do with it being cautiously or incautiously written, which of course does not prevent one from baselessly bashing PHP.
    – StasM
    Commented Jan 17, 2012 at 6:47
  • @StasM: of course it has to do with it. The programming language is important; to take the extreme, it is much more difficult to write a bug-free (or, at least, not too much vulnerable) server in C or assembly, than it is with languages with more safeguards such as Java or, for that matter, PHP. For Web servers specifically, PHP's record is not thoroughly good (in particular, it should make it much more difficult to make handmade SQL requests, and should force use of prepared statements).
    – Tom Leek
    Commented Jan 17, 2012 at 14:06
  • @TomLeek sorry, I don't see how that makes sense - you can run bare SQL in any language that supports direct DB query (which is all of them that support connecting to DB). Security practices are well-known and are the same for PHP as for any other language. There's no such thing as "PHP record" because each software is written in a different way by different people. It's like saying electricity is bad because all computers that were hacked used electricity. It's just FUD stemming from repeating third-party misinformation without bothering to check the actual facts.
    – StasM
    Commented Jan 17, 2012 at 20:32
1

Well as you said, PHP is server side so that means that the code is executed inside the server and the browser will just interpret the response.

So PHP files doesn't have effect upon client's computer, because there is no code execution in it.

Edit: We are just talking about PHP and no other things.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .