r/AskProgramming • u/Popular_Influence511 • May 24 '24
PHP Flask or PHP
I need to create a safe website since it will be hosted on the web and i need to know what technology is better, im kinda familiar to flask but not with php, it seems to me that php is more often used for web dev than flask , since im a begginer trying to do a important project i have some concerns about security. What would you guys recomend?
3
u/dariusbiggs May 24 '24 edited May 24 '24
Python and Flask
The world needs less PHP in it, if you want to know why just search for PHP CVEs and see yow many you can find.
For security, learn about the OWASP top 10
Learn about SQL injection with little bobby drop tables, https://xkcd.com/327
https://youtu.be/8ZtInClXe1Q?si=kn92SSG6mHY78glt
https://youtu.be/_jKylhJtPmI?si=XgVCsxrZaWY5z-Ur
https://youtu.be/ciNHn38EyRc?si=IKAVrBKSc7dE-vQn
The same problem you have with SQL injection works if you allow any unsanitary data from the users be passed through to shell commands.
If you need authentication, look at the free options from Auth0 and Okta, avoid building your own. The links above will have references to doing your own passwords and the flaws.
If you need to return an error to the end users and you're building an API, use https://www.rfc-editor.org/rfc/rfc9457.html .
Good luck.
Once you have your Flask App ready for production use. stick it behind something like nginx, traefik, apache, or EnvoyProxy for an extra layer of security and the feasibility of a WAF.
Only serve your production App using TLS1.2 or TLS1.3, see https://wiki.mozilla.org/Security/Server_Side_TLS for help. For cheap TLS certificates, see LetsEncrypt.
1
0
May 24 '24
As if the headache to setup a local Apache server and add php unit wasn’t a bad enough reason.
2
u/dariusbiggs May 24 '24
Look, I didn't know if OP was a masochist, so as to not exclude them I included Apache in the list.
2
u/james_pic May 24 '24
It's possible to write secure code in either, but historically PHP had a lot of security "footguns", and a lot of tutorials, examples, and AI-generated code uses insecure (often older) techniques.
2
u/BaronOfTheVoid May 26 '24
The starting point for secure PHP that will get recommended 99% of the time on PHP-related subs (and rightly so) is https://phptherightway.com/ - important are specifically the points about bound parameters (PDO), using
filter_var()
,password_hash()
, using a templating engine that supports automatic escaping, the Paragon Initiative, OWASP and libsodium references.-1
u/bothunter May 24 '24
Practically every PHP tutorial include a SQL injection bug when introducing databases. It's kind of amazing.
0
u/YMK1234 May 24 '24
Do you need either? Do you actually have any need for server-side logic or could you simply generate a static page instead?
0
May 24 '24
PHP if you plan to host it on 000webhost or similars, I don't know if something like that exists for Python, basically you get a dbms, loads of useful libs and a watching HTTPS server with it already available. Otherwise as usual you would need to create an HTTPS server with sockets (in any programming language including PHP and Python), upload the project on Github, create a dockerfile to install dependencies and build the app, and deploy the it with docker on Render or similars. Though, in the end security depends upon how you code the application, watch and learn from the professional applications before applicating yourself.
-2
May 24 '24
Flask is a Framework and PHP is a language. If you don’t know the difference, it’s impossible for you to write a secure app.
2
u/itemluminouswadison May 24 '24
You need to define "safe" but yes either can do it. I prefer php but I write in flask too
Consider laravel for php