I have been told that generally speaking, asp.net web apps tend to be more secure than php, since asp.net has some automatic security measures, for example, by default it doesn't allow remote file inclusions. And when you code in php, you have to take care of those things yourself, so some developers might forget to do that. So my question is, generally speaking, are asp.net web applications more secure than php web apps?

  • The problem with php isn't remote file inclusion on similar features. It's the broken type system. – CodesInChaos Mar 12 '13 at 13:23
  • 1
  • @CodesInChaos what do you mean exactly about broken type system? – Salvador Dali Mar 12 '13 at 17:10
  • @SalvadorDali For example all those nonsensical implicit conversions, ignoring type mismatches(sometimes outputting a warning), etc. – CodesInChaos Mar 12 '13 at 20:18
  • @CodesInChaos I think that perl, have similar implicit conversion, and there is nothing wrong with this. – Salvador Dali Mar 12 '13 at 22:29

ASP.NET will be more secure than PHP if the developer masters ASP.NET more than PHP. And vice versa.

There are many claims that a lot of features of PHP seem to have been designed by a lemur who had taken acid, leading to a rather tortuous set of features and thus potentially making the task of developing securely rather harder than what it could have otherwise been. However, these details are dwarfed by the skills of developers, or lack thereof. Regardless of the language details, the developer must think of "what could go wrong with the code" and there is no automatic tool which will do the thinking for him.

Not the answer you're looking for? Browse other questions tagged or ask your own question.