PHP vs Perl CGI script security

Anon

I maintain a web server that has over 70 users. Many of these users want to use cgi scripts but I typically don't allow them for security reasons. My worries are that a user will intentionally or unintentionally create security holes or possibly create a script that will attack other machines. Would PHP be a more secure service in this situation, or are the risks the same?

brandonschnell

the risks are the same.

you can use php in "safe mode" and prevent users from using specific php functions. depending on how worried you are you might want to disable uploads, and any of the functions for local file access or running local commands.

Anon

i sure as @!#$ hope you don't charge these people if you can't figure stuff like this out.

brandonschnell

if you're referring to bob, look at his email address. you'll notice that it ends in usda.gov. my guess is that he's running a small web server among his other normal job functions for the usda. in that case i doubt he's being paid enough for his services.

Anon

Thanks, and your right. The web servers that I maintain are a free service and I only have a little time to spend on them. If that changes to a fee for service then I’m sure full time expert(s) will be needed. I’m just looking for a little advice. The PHP manual says that PHP is more secure than Perl and C scripts, but it seems that it has most the pitfalls that they do in a shared environment. I was unaware that there was a safe-mode, so I'll look into that some more to see if meets my needs.

Thanks!