PHP: Is it secure/stable enough for Government Usage?

randomblink

Question:

I work in City Government.
I want to get PHP installed so I can get Postnuke installed.
I want to run Postnuke as an Intranet.
My IT department does not like PHP.
They lump it in with Apache and MySQL as unstable.

Can anyone give me some sites with information on them?
I would like to put together an intelligent reason to allow PHP.

(now then, I have heard people say to stay away from postnuke, however I am using it on two personal sites of my own and I love it... not a problem 1... so please don't waste my time trying to move me away from postnuke... just data on PHP please... pros and cons...)

The IT person setting up a testbed for me said the following:

We've pretty much done away with any Apache and any other freeware (like MySQL), since that stuff has proved to be unstable. I do wish you could do your stuff in ASP, because, although it is fine in a test environment, my boss probably wouldn't want to put PHP on our production servers.

If you can help me... please do... if not, thanks for reading...
Pro's AND Con's for PHP...
Thanks...

mknudsen

Well you can tell the guys in the It department that yahoo are moving some of their systems to PHP, theres a article about it here. http://public.yahoo.com/~radwin/talks/yahoo-phpcon2002.htm

stolzyboy

apache is sure as heck more secure and more stable than iis ever has or will be, IMHO, and yes php is secure as well, go to www.dotster, a registrar, they use php, as well as many secure sites

hi-liter

i did some work for a college recently that was in the process of switching from IIS to Apache, due to too many security holes in IIS.

web search on "asp vs. php security" and "apache vs. iis" returns a slew of entertaining/educating reading.

just my 2¢

Weedpacket

Of course, the security of a site is only as good as the site administrators make it 🙂; it's just that it's easier to maintain a secure and stable site with Apache than with IIS (in no small part because the former is open source).

matt_4013

PHP is not insecure, it's the way people code that compromises the server. Probably the best thing to do is have a look around through the actual Security Bulletins for each server.

IIS 5.0
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/current.asp?productid=17&servicepackid=0

Apache 2.0
http://www.apacheweek.com/features/security-20

There's just the tiniest difference in vulnerabilities there 😉

feldon23

PHP is secure.

Your big question is Postnuke. I know PHPNuke has holes that you can drive trucks through.

feldon23

ASP/IIS more stable/secure than Apache/PHP/MySQL?

HAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHA

I think you need a new IT department. 🙁