I admit, PHP sucks. But there is one thing it has going for it. It's simple to configure and secure a server that your general userbase can run applications on. I work at ITECS, the Engineering IT department at NC State University. ITECS is responsible for maintaining the server infrastructure for dozens upon dozens of university Web sites, most of which have dynamic content. Not to mention the people server, which anyone affiliated with the College of Engineering can get directory space and a MySQL database on.
I was once talking to our Systems people about, why not allow Python applications. They said that every time they have experimented with allowing CGI scripts in any language supported by their Web servers, someone has always found a way to exploit their sandbox. With PHP, the applications can still get exploited, but they have never had a breach that affects the servers themselves.
So if you're a startup or a major tech company who can spend time customizing a Web server and trust everyone who has access to it, then you're crazy for using PHP. But if you're a college with 8,000 students, almost 1,000 faculty, and a bunch of support staff in addition, and a good quarter of them need Web sites, PHP's pretty much the only option that will keep you sane.
In my opinion, that's something that seriously needs fixing. But it's certainly an explanation for why PHP is still around now.
That's odd, because usually servers get owned from faulty wordpress/joomla instances. I rarely hear of web servers getting rooted via web apps run on python. I'm not really an experienced php dev myself, and when I installed joomla on my vm last year, it was rooted within the hour -- I was notified by a data center admin saying my vm was using an insane amount of bandwidth. I'm sure it was some script scanning for boxes with slightly old versions of joomla. I haven't had the same kind of bad luck installing python apps.
The PHP on our servers is also ridiculously locked down due to a combination of php.ini sandboxing settings including open_basedir (which AFAIK no other language has out of the box) and very strict AFS permissions (the server only has access to your specific Web locker, and it only has write permissions if you specifically enable them in the locker portal).
Whoa. Definitely don't run Python as CGI. Use WSGI, run your app as a devoted low-priv user, proxy to it. Then you have only one entry point; there IS no sandbox, and nothing to exploit.
I agree. Why not run the webapp as the user account the code belongs to. With virtualenv and pip, normal users can install modules into their own site-package in their home folder, and any runserver started as them will only have permission to access anything they have access to. The only thing that is possible to exploit is what they've allowed in their code, but that's pretty much the same issue you have with php.
Because (a) mod_wsgi is nowhere near as easy to sandbox as PHP (again, php.ini settings), (b) configuring proper production servers to run as specific users is a pain, and (c) this is a university where people have access to sensitive student information and research data in the AFS system. How bad do you think it would be if a random student could exploit their professor's site and change their exam grade?
I was once talking to our Systems people about, why not allow Python applications. They said that every time they have experimented with allowing CGI scripts in any language supported by their Web servers, someone has always found a way to exploit their sandbox. With PHP, the applications can still get exploited, but they have never had a breach that affects the servers themselves.
So if you're a startup or a major tech company who can spend time customizing a Web server and trust everyone who has access to it, then you're crazy for using PHP. But if you're a college with 8,000 students, almost 1,000 faculty, and a bunch of support staff in addition, and a good quarter of them need Web sites, PHP's pretty much the only option that will keep you sane.
In my opinion, that's something that seriously needs fixing. But it's certainly an explanation for why PHP is still around now.