PHP is totally about security!!

What? What about phpbb? I dont know what you're talking about??

Language has a lot to do with it. Both functionality and community/culture. There are more buffer overflows with C code than Java. The PHP community is more newbie than, say, the Ruby community.

These look like real security problems in the language. (Unless you define "functions can do arbitrary things with weird inputs" as part of the language. This is certainly the case in C, but I don't think that's within any programmer's mental model with these higher-level languages.)

Agreed. I don't even consider buffer overflows when writing PHP and Perl: I write with the assumption that the language and core libraries are perfect. You could argue that I should be more paranoid, but then I'd argue that it makes all high level languages a sham.

When I write in C, of course, I'm constantly thinking about memory-related issues because C doesn't attempt to abstract these issues away.

Mediawiki has issues from time to time but security things are cleaned up fast, in part because of the really high profile test site.

I expect a security pro could find at least ten issues if they went looking - question of time to find rather than whether they are there or not. If any security pros read this, give it a try and let me know time to find ten and their details - and we'll promptly fix them, of course.

Not surprising that Brad and co are being paranoid, given their own high profile test site.:) Good to see it.

As far as I know, PHP's HTTP fopen wrapper doesn't care about any of this stuff. It's provided as a quick shortcut, but you're supposed to do it properly if it matters to you. (No-one ever does, but that's PHP programmers for you.)

PHP also has a limit on how long a script can run in total, which serves a similar purpose to the timeout in ParanoidAgent when it comes to tarpitting servers.

I can't speak for the built-in fopen wrappers, but cURL (which has PHP bindings) supports at least the timeout and tarpitting. I haven't checked to see what options are available to restrict connecting to reserved IP blocks, though I'm fairly sure that those could be resolved and checked by using the dns_get_record function.

See here (specifically the options CURLOPT_MAXREDIRS and CURLOPT_TIMEOUT).

I'm not going to get into a religious language war since I agree with most everyone here about the caliber of most PHP programmers out there, but remember that there are exceptions. Besides MediaWiki, I'd also point to anything Horde has done as an example of extremely high-quality PHP.