Re: [PHP-WEBMASTER] Security Question

On Mon, Oct 27, 2008 at 19:56, Jeremy Seibert <[email protected]> wrote:
> * Hi,
>
> Im contacting you because I have a question, at my old job i developed
> scripts using PHP, I started at my new job and they don't have PHP installed
> on our servers, I asked why and they copied and pasted this snippit out of
> their refrence manuals.
>
> my question is, is what they say about PHP true? about how it requires CGI
> to be activated? because I want to fight this issue and was hoping that it
> wasn't true, and I figure what better source to prove them wrong than from
> php.net. they don't want php installed on their server because they think
> its some sort of security issue.
>
>
> "Because of the inherent security risks associated with common gateway
> interface (CGI) modules, (Company Name) does not allow CGI in the shared
> hosting environment. The stated direction for CGI is to convert all related
> code to another supported programming environment such as Java. If CGI
> support is an absolute requirement, then the system must reside on either a
> deviation server, dedicated server, or a dedicated zone. Additionally, an
> approval to use CGI must be obtained from (Company Name)'s IS&S Security.
> Note that this restriction applies to all languages which would require CGI
> to be activated for use with the web server, including: Perl, PHP, and
> Python."

Thats an awesome snippet. Hope you don't mind me pasting it to friends? :)

PHP does not require CGI anyway (and was in fact not the recommended way).

-Hannes