| [reply] |
... which is better to use for a secure site... [perl stuff / PHP stuff]
It depends on what your definition of a 'secure site' is. If you mean something that might handle credit card numbers ofr another objective that requires a higher security level, then neither perl not php alone will suffice. Text is passed from the client to the server in broad daylight, meaning that the text can be grabbed anywhere along the way to the server. To fix this, you should immediately consider using the https protocol (a secure http protocol) if the data passing between client/server must be hidden from prying eyes.
If you meant 'security' as far as making sure that the person accessing the server is the person you think they are, then I suppose either solution (that of perl or php) would suffice. If you are already using perl for backend purposes, there is no reason to crawl towards php. CGI, DBI and Apache::Session would do, though I might suggest MD5 for the creation of session IDs. As already mentioned, merlyn's column on the proper use of cookies and session management is an excellent source of good advice on how to do things the right way. That column (like so many of merlyn's) is worth a read or two (or three).
| [reply] |
MD5 isn't meant for use in new development. Use SHA1 instead. There was a recent thread on the secure development list on security focus. MD5 is "safe" for today but there are questions about the near future.
Seeking Green geeks in Minnesota
| [reply] |
Try not to mix your peas and mashed potatoes if you can help it. If you need Perl, use Perl. If you go down a pure Perl route, I'd explore more sophisticated modules than CGI.pm for the front end, such as HTML::Mason or Template::Toolkit.
If you go down the PHP route, make sure that you read the comments within the php.ini file for your installed version. Up till recently the default configuration was rather insecure.
()-()
\"/
`
| [reply] |
What's your skills mix? Are you going to have to learn PHP to implement anything with it? Do you have a couple of designers who know PHP but no Perl? The answers to these, and questions like 'em should help guide your choice.
| [reply] |
Apache::ASP rocks. Before anyone flames, go take a serious look at it first, 'k?
It handles session data and creation automatically, runs under mod_perl for performance. This takes the best parts of php and asp, and uses perl as the main language.
http://www.apache-asp.org/ | [reply] |