What you've so brilliantly and unwittingly illustrated here is that PEOPLE MAKE MISTAKES. And that contradicts your argument that attempts to shift the blame for PHP's footguns like mysql_real_escape_string onto "crappy coders" instead of the culture and designers of PHP itself. People love to use that argument the self-aggrandize themselves, claiming they're too smart to make those mistakes, and only crappy inexperienced coders do that, so it's not a problem.
But PHP has always been widely evangelized to inexperienced coders, foot-guns and all.
Yes it DOES make a difference if a language is full of foot-guns, and the culture and developers around it don't give a shit (and don't bother running tests before checking in buggy changes to crypto functions before making a release) because they think they're too hot-shot to aim the foot-guns they designed and loaded at their own feet, then go around evangelizing their language to inexperienced crappy programmers.
https://www.php.net/archive/2011.php#id2011-08-22-1
5.3.7 upgrade warning
[22-Aug-2011]
Due to unfortunate issues with 5.3.7 (see bug#55439) users should postpone upgrading until 5.3.8 is released (expected in a few days).
https://bugs.php.net/bug.php?id=55439
Bug #55439 crypt() returns only the salt for MD5
https://news.ycombinator.com/item?id=2912678
Do not upgrade to PHP 5.3.7 due to a bug in crypt() (php.net)
https://news.ycombinator.com/item?id=2913310
dramaticus3 on Aug 22, 2011 | parent | favorite | on: Do not upgrade to PHP 5.3.7 due to a bug in crypt(...
Get ready for some WTF-ery Crypt takes an optional salt. If that value is an MD5 hash it is prefixed with the chars $1$ to tell the underlying crypt(3) function to use Modular Crypt Format[1]. MCF is an ad-hoc cruft because the orginal crypt() is weak.
Anyway guess who did it :
"let's use strlcpy/strlcat instead for these static string copies" - Rasmus I guess that's Lerdorf himself
Whoever it was also didn't check the return values for error. Strlcat returns the length of the new string which might not be the same as strlen(dst) + strlen(src).
"I'm not a real programmer. I throw together things until it works then I move on." - Rasmus Lerdorf
Here's where he broke it : Sun Aug 7 16:10:34 2011 UTC http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php...
Here's it being fixed : Fri Aug 19 22:49:18 2011 UTC http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php...
[1] http://packages.python.org/passlib/modular_crypt_format.html
rll on Aug 22, 2011 [–]
If you have never broken anything you have probably never built anything.
dramaticus3 on Aug 22, 2011 [–]
The project leader. Tests, I'm in charge, I don't test.
dangrossman on Aug 22, 2011 [–]
This code had a unit test, and it failed after the change as expected:
http://gcov.php.net/viewer.php?version=PHP_5_3&func=tests&fi...