<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 07/22/2013 10:46 AM, Andy Borgmann
wrote:<br>
</div>
<blockquote
cite="mid:CABGEp7q9XQs3mB5Rh65C4dzektgwFOSBV1T6z-xstj3Ms-JH0g@mail.gmail.com"
type="cite">
<div>"<font face="arial, sans-serif">Have fun rewriting your code
for PHP 5.4 and later releases, by the way." - you really are
a bit passive aggressive aren't you.</font></div>
</blockquote>
<br>
No. Sarcastic, sure.<br>
<br>
I am surprised that people within the last five years, despite the
official PHP project's insistence that these things shouldn't be
used, are still used, though. An ounce of prevention... I've had
to do large-scale audits and fixes for PHP applications when the
base system closes a huge hole or changes something drastically.
They're never fun, and they always cost more in time, money and
aggravation than they're worth. And you can never have the time
required to make all the fixes that need to be done, either.<br>
<br>
I actually don't do that anymore—when I see a project that looks
like it wasn't written by a programmer, or when I see a project when
I don't have to look in more than a single file to find more than
one blatent vulnerability, I refuse to proceed any further. I've
been down that rabbit hole one time too many, and those projects
never go well—in the end, the client is unhappy and will almost
always keep the insecure system in production rather than pay for
the time required to fix it fully, even after a significant amount
of work has been done on it.<br>
<br>
I will rewrite their systems for them, though, and that is usually
the most expedient route. Collect all the requirements, functional,
non-functional and security, and then design a clean system such
that it can be implemented without relying on any insecure
functionalities. And to be honest, writing code in a secure way
up-front not only saves time and frustration later, but it makes the
code a great deal easier to work with.<br>
<br>
<blockquote
cite="mid:CABGEp7q9XQs3mB5Rh65C4dzektgwFOSBV1T6z-xstj3Ms-JH0g@mail.gmail.com"
type="cite">
<div><font face="arial, sans-serif">Needless to say, thank you for
your thoughts. I genuinely appreciate them. I have learned a
few things here today, which is the whole reason I monitor
(but rarely jump into) the discussions here. Much
appreciated.</font></div>
</blockquote>
<br>
Glad to be of help. (Not being sarcastic there.)<br>
<br>
<div class="moz-signature">-- <br>
<table border="0">
<tbody>
<tr>
<td> <img src="cid:part1.01090609.00090808@naunetcorp.com"
alt="Naunet Corporation Logo"> </td>
<td> Michael B. Trausch<br>
<br>
President, <strong>Naunet Corporation</strong><br>
☎ (678) 287-0693 x130 or (888) 494-5810 x130<br>
<br>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>