bugtraq - RE: PHP security (or the lack thereof)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <EKECJMGPAACGOMIGLJJDIEFHHGAA.geoincidents@nls.net>
Date: Mon, 26 Jun 2006 12:06:42 -0400
From: "Geo." <geoincidents@....net>
To: <bugtraq@...urityfocus.com>
Subject: RE: PHP security (or the lack thereof)

...
>   "The configuration flexibility of PHP is equally rivalled by the code
> flexibility. PHP can be used to build complete server applications,
> with all the power of a shell user, or it can be used for simple
> server-side includes with little risk in a tightly controlled
> environment. How you build that environment, and how secure it is, is
> largely up to the PHP developer."

And is the default install wide open or tightly controlled? I mean from a
security standpoint we have been screaming for years at Microsoft to change
their defaults to firewall on and things locked instead of open.

Is php secure by default when it's installed on a server?

Geo.