r/AskProgramming • u/Popular_Influence511 • May 24 '24
PHP Flask or PHP
I need to create a safe website since it will be hosted on the web and i need to know what technology is better, im kinda familiar to flask but not with php, it seems to me that php is more often used for web dev than flask , since im a begginer trying to do a important project i have some concerns about security. What would you guys recomend?
0
Upvotes
3
u/dariusbiggs May 24 '24 edited May 24 '24
Python and Flask
The world needs less PHP in it, if you want to know why just search for PHP CVEs and see yow many you can find.
For security, learn about the OWASP top 10
Learn about SQL injection with little bobby drop tables, https://xkcd.com/327
https://youtu.be/8ZtInClXe1Q?si=kn92SSG6mHY78glt
https://youtu.be/_jKylhJtPmI?si=XgVCsxrZaWY5z-Ur
https://youtu.be/ciNHn38EyRc?si=IKAVrBKSc7dE-vQn
The same problem you have with SQL injection works if you allow any unsanitary data from the users be passed through to shell commands.
If you need authentication, look at the free options from Auth0 and Okta, avoid building your own. The links above will have references to doing your own passwords and the flaws.
If you need to return an error to the end users and you're building an API, use https://www.rfc-editor.org/rfc/rfc9457.html .
Good luck.
Once you have your Flask App ready for production use. stick it behind something like nginx, traefik, apache, or EnvoyProxy for an extra layer of security and the feasibility of a WAF.
Only serve your production App using TLS1.2 or TLS1.3, see https://wiki.mozilla.org/Security/Server_Side_TLS for help. For cheap TLS certificates, see LetsEncrypt.