<story><title>Our Ambitious Plan to Make Insecure PHP Software a Thing of the Past</title><url>https://paragonie.com/blog/2018/01/our-ambitious-plan-make-insecure-php-software-thing-past</url></story><parent_chain><item><author>mywittyname</author><text>I think it would be better to write a plugin for various PHP IDEs that contain fingerprints of bad code which is used to yell at the programmer if they are using these old, insecure code snippets.  Heck, you could add a feature or note to the developer to down-vote the source of said code.&lt;p&gt;It would be a lot of work, but I think it&amp;#x27;s easier than trying to get authors of defunked blogs to take down 10 year old answers.&lt;p&gt;As a side-effect, this increases awareness among developers that you can&amp;#x27;t blindly accept what&amp;#x27;s on SO.  If developers begin to lose trust in SO, then SO is going to be incentivized to do something about, or go the way of expertsexchange.</text></item></parent_chain><comment><author>klodolph</author><text>This is called static analysis and it&amp;#x27;s a very active field of research. The main pain is figuring out which analyses to enable in existing code bases, because if you have a hundred diagnostics from legacy code you don&amp;#x27;t want to deal with, you&amp;#x27;re going to miss the one or two new warnings in the code you just added.&lt;p&gt;For greenfield projects it can be a godsend, if you have the experience to know which warnings you should disable and the discipline to keep the entire code base warning-free. I&amp;#x27;ve done this with StyleCop &amp;#x2F; FxCop in C#.&lt;p&gt;Here&amp;#x27;s a list of PHP static analysis tools: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;exakat&amp;#x2F;php-static-analysis-tools&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;exakat&amp;#x2F;php-static-analysis-tools&lt;/a&gt;</text></comment>
<story><title>Our Ambitious Plan to Make Insecure PHP Software a Thing of the Past</title><url>https://paragonie.com/blog/2018/01/our-ambitious-plan-make-insecure-php-software-thing-past</url></story><parent_chain><item><author>mywittyname</author><text>I think it would be better to write a plugin for various PHP IDEs that contain fingerprints of bad code which is used to yell at the programmer if they are using these old, insecure code snippets.  Heck, you could add a feature or note to the developer to down-vote the source of said code.&lt;p&gt;It would be a lot of work, but I think it&amp;#x27;s easier than trying to get authors of defunked blogs to take down 10 year old answers.&lt;p&gt;As a side-effect, this increases awareness among developers that you can&amp;#x27;t blindly accept what&amp;#x27;s on SO.  If developers begin to lose trust in SO, then SO is going to be incentivized to do something about, or go the way of expertsexchange.</text></item></parent_chain><comment><author>astrodust</author><text>If you ever type in mysql_query it should archive your project, encrypt it, and hold it for ransom until you apologize and promise to never touch that function ever again.</text></comment>