Is PHP prone to vulnerabilities?

[REMIYA]

Look at these 3 URLS:

PHP
http://osvdb.org/searchdb.php?action...&Search=Search

Python
http://osvdb.org/searchdb.php?action...&Search=Search

Ruby
http://osvdb.org/searchdb.php?action...&Search=Search

In short:
230 pages of PHP vulnerabilites compared to 25 Python vulnerabilities and 17 Ruby vulnerabilities

Does it mean PHP is more prone to vulnerabilities?

[praetor]

Those aren't php vulnerabilities, but application ones.

[veridicus]

Almost all of those vulnerabilities are caused by bad programming, not the PHP language or runtime itself. What insecurities there are in PHP itself are rarely exploitable through the browser.

One reason the PHP list is so much longer is because many more commonly-used applications are written in PHP than Python or Ruby.

[jestep]

I have to agree that vulnerabilities are normally properties of bad coding, and not of a programming language.

If you take into account that a huge percentage of php users don't know the difference between a markup language and a programming language, it's no wonder that there are so many poorly coded php applications.

[pjleonhardt]

I have to agree that vulnerabilities are normally properties of bad coding, and not of a programming language.

If you take into account that a huge percentage of php users don't know the difference between a markup language and a programming language, it's no wonder that there are so many poorly coded php applications.

Or the number of times I've had the following conversation..
Them: "Why don't my scripts work when I moved servers?"
Me: "Check your register_globals setting"
Them: "Whats that?"

Ugh..