In other words, my (long version) question is: Are developers able to get away with, more using ASP.net than PHP in terms of writing secure code for their apps?

I ask this because ASP.net has many built-in security mechanisms such as SQL injection prevention. PHP, as far as I know, does not, at least not in that sense. PHP does give you the tools to do it, like wrapping each query with mysqli->real_escape_string(), but it's my understanding that ASP.net automatically does it for you. I generally structure my PHP apps in a way that are very secure, but we all know there are countless PHP programmers out there who either do not have basic security knowledge or simply do not care, resulting in tons of vulnerable apps. I'm wondering that if such careless programmers used ASP.net instead, would some of their carelessness be automatically patched up.

  • 2
    Not an answer, but an anecdote: I have seen web developers do truly horrific things inside ASP.NET, including purposefully circumventing some of the basic security features we have built in. For example, it's not uncommon for developers to use plaintext authentication cookies simply because they don't want to synchronize across their apps the cryptographic keys which are normally used to protect those cookies. Unskilled developers are always going to find ways to shoot themselves in the foot - even if they have to go out of their way to do so - regardless of the framework they're using. – Levi Feb 10 '14 at 0:25

Your question is a bit too broad and a bit opinion-based. That's why this is not a full answer.

PHP has its downsides, and so pretty much every other language. Intrinsically, PHP isn't tangibly less secure than other languages in the same field. PHP has its built-in database abstraction layer PDO that has anti-SQL-injection features such as parameterized queries. PHP also has many security-oriented libraries and frameworks that handles everything from XSS protection to CSRF protection. Other languages have similar features.

In an of itself, PHP isn't weaker than other languages. The issue with PHP is its release cycle, its interpreter's some-time-incompetent developers, and the abundance of wrong and misleading information on the web.

Bottom line is: An incompetent developer will write an insecure application whether with PHP, .Net, or Python. A competent developer will write a relatively secure application with any language they choose, but with PHP it's gonna be slightly more difficult (only slightly).

Not the answer you're looking for? Browse other questions tagged or ask your own question.