In recent years, Python has experienced an explosion in popularity. According to the TIOBE Index, as of August 2022, Python overtook C to become the most popular programming language with a rating of 15.42% and is likely to keep growing. [6] Its popularity is mainly attributed to its simple and easy-to-read syntax.

Since Python is easy to code and also user-friendly, it is much easier on an individual quality analyst level to catch mistakes and errors in programs that could cause security issues. According to mend.io, only 6% of all reported open-source vulnerabilities are from websites written in Python. Furthermore, on average, only 15% of Python’s severity vulnerabilities in the past five years are considered high risk, which is relatively low compared to other major coding languages [7] .

However, Python also has some security vulnerabilities that are worth considering. There are four principal security vulnerabilities according to Python’s CWE (Common Weakness Enumeration) list. In order from most frequent to least, Input Validation (CWE-20), Permissions, Privileges, and Access Control (CWE-264), Cross-Site Scripting (XSS) (CWE-79), and Information Leak/Disclosure (CWE-200) affect Python language-based scripts [7] .

In further analysis, Python security risks are primarily a result of insufficient user input validation [8] . Input validation is how a program can ensure the data being entered by a user is not malicious, incorrectly formatted, or wrong in other ways. A program can avoid leaking important information by sanitizing the user’s input.

Additionally, Python is a type-safe language. This means it checks for type errors when the program compiles, known as compile time. On the other hand, languages that are not type-safe check for type errors at runtime. This is advantageous because it leads Python to be less error prone. Languages that are not type-safe, such as C and C++, are susceptible to error due to not having type safety.

JavaScript is a popular language, and according to the TIOBE Index, JavaScript ranks seventh on the list of the most popular programming languages in the world, with a rating of 2.33% as of August 2022 [6] . However, Stack Overflow, a popular programming website, posted a developer survey in 2021 that claimed JavaScript was the most popular language. 64.96% of respondents and 68.62% of professionals chose JavaScript as their most heavily favored and used development language [9] . JavaScript underpins nearly 95+% of websites accessible today, emphasizing the widespread nature and havoc cyberattacks could wreak by exploiting a singular vulnerability [10] .

Despite being so popular, JavaScript has more vulnerabilities than Python. According to mend.io, 11% of all reported open-source vulnerabilities are from websites incorporating JavaScript. Mend.io also states that, on average, 31% of vulnerabilities identified in websites incorporating JavaScript contained high-risk vulnerabilities over the last five years, more than double that of Python.

According to mend.io, JavaScript is vulnerable to three main CWEs: Cryptographic Issues, Path Traversal, and Cross-Site Scripting (XSS), the first two relatively uncommon among other top programming languages. Additionally, Michael Hollander claims that SQL injection and sensitive cookie exposure are among the top vulnerabilities of JavaScript [10] .

Java is extremely popular as well. According to the TIOBE Index, which is a measure of relative programming language popularity, Java is ranked third in popularity at 12.40% [6] . Also, Java is a type-safe language, which is beneficial in minimizing type errors. Furthermore, Java technology is utilized by six million developers across billions of devices [11] . As a result, any significant vulnerability found in Java could potentially result in billions of devices being at risk of being hacked. Therefore, it is crucial to examine whether Java is secure.

According to mend.io, Java comprises 11% of all open-source security vulnerabilities, placing it in the top 3 in this category. However, the number of websites coded with Java containing high-severity security vulnerabilities averages roughly 19% but has been declining since 2015. Additionally, Java shares Python’s top four CWEs: Information Leak/Disclosure, Input Validation, Cross-Site Scripting, and Permissions, Privileges, & Access Control [7] . Java and Python have several similarities, which provide a reason why their top security vulnerabilities are the same.

However, being listed among the top CWEs does not indicate a critical vulnerability. Static application security testing (SAST) helps identify code vulnerabilities. The most common code vulnerability identified through this process was the Unpatched Libraries vulnerability [12] . Furthermore, S. Rahaman et al. concluded that on a cumulative evaluation of Android applications, these applications draw their vulnerabilities largely from packaged libraries of code [13] . Unpatched libraries occur when versions of coding languages are updated to patch vulnerabilities found in libraries. Lists of these vulnerabilities can be found in databases such as the National Vulnerability Database or the CVE database. Coding languages can be vulnerable to attackers who know these vulnerabilities when not updated.

C is a relatively old language still in use. According to the TIOBE Index, C ranks second in popularity to Python and ranked first before August 2022. However, according to a survey by Stack Overflow, only 21.01% of respondents have done extensive development work with C [6] .

Despite its broad applicability, there are three significant components to this need for more familiarity with C. 1) C is not very user-friendly and is challenging to master due to syntax requirements and hard-coding practices. 2) C contains security flaws and infrastructure weaknesses that are easy to exploit [14] . 3) C is not type-safe, making C increasingly liable to type errors. Mend.io states that C has the most vulnerability out of the above languages, encompassing 50% of all reported vulnerabilities in a decade. However, this last type-safety argument may be unreliable, as it is worth mentioning that the length of time that C has been around and the mass of code that relies on C may skew this data improperly [7] .

C’s top CWE is the Improper Restriction of Operations within the Bounds of a Memory Buffer, scoring 75.56 out of 100. Out-of-bounds Read is the second-most common CWE with a score of 26.5, far less common than the prior [15] .

C++ ranks fourth on the TIOBE Index, with a rating of 10.17% [6] . However, according to the Stack Overflow Developer Survey, 24.31% of respondents have done extensive development using C++, which ranks 10th on this survey. This points to the improvement in user accessibility and ease of use.

Similar to the above, in terms of security, C++ is not type-safe, so it is vulnerable to type errors. Notably, C++ has two significant unique security risks. First, C++ has the highest % of high-severity security vulnerabilities in this group at 36% [7] . Secondly, C++’s top CWE is Buffer Errors, which accounts for over 50% of all CWEs. According to mend.io, these Buffer errors, referred to by CWE code 19, have been incredibly prevalent within C. As explained by the lead-time fallacy of C, it is now becoming apparent that they are not unique to C. C++ has seen a sharp spike in these errors since 2017 [7] . Furthermore, as shown in Figure 2, C and C++ are uniquely responsible for a significant portion of CWE vulnerabilities [16] .

According to the TIOBE Index, PHP is ranked tenth with a popularity rating of 1.39% [6] . 21.98% of respondents to the Stack Overflow 2021 Survey state that they have done extensive development with PHP [9] . PHP is especially popular in website development, with continuous growth and applicability [17] . This is primarily due to web developers’ use of PHP in creating dynamic content and utilizing strong database support systems. Overall, this can provide a user-friendly experience [18] .

Of security, according to mend.io, 16% of websites coded with PHP in the last five years were found to contain high-severity vulnerabilities. PHP has one clear top CWE: Cross-Site Scripting, or XSS. While we have explored the prevalence of XSS CWEs in depth, PHP is the only language with prominent SQL Injection (CWE-89) vulnerabilities [7] .

Python has a relatively low number of vulnerabilities, which is a positive feature as it is one of the most used programming languages. Most of its applications involve image processing and graphic design applications [19] . Furthermore, Python can be used in website/software development, data analysis, and task automation. Since Python is very user-friendly, easy to learn, and has a simple syntax, many accountants and scientists can also utilize it for their job requirements [20] . It is often heralded as a beginner-friendly language for new web developers and computer science students.

JavaScript is a client-side programming language mainly used in web development, specifically to make websites dynamic and interactive [21] . 98.0% of all websites use JavaScript as a client-side programming language [22] . JavaScript vulnerabilities can be high-stakes as one of the more popular languages underpinning some of the heaviest trafficked web pages without significant failures or security risks. Examples include Google, YouTube, Facebook, Wikipedia, and Amazon. As a result, any vulnerability found in JavaScript can be used cross-applied across several websites that are not only important but can be financially catastrophic.

Java can be used to construct applications on several platforms, particularly for the recent video gaming boom [23] . However, Java is not limited to mobile and computer applications. One of the more novel security risks that have emerged from using Java comes from the National Aeronautics and Space Administration (NASA). One of NASA’s recent endeavors has been WorldWind, a publicly accessible application allowing high-resolution camera monitoring from satellite feed onto nearly any location on Earth [24] . As a result, a security vulnerability in Java could result in apps being targeted by attackers and potentially crashing.

As established, the relatively higher number of C-specific vulnerabilities and their prevalence compared to other languages means that any application based on C has an increased security risk. The applications of C are just as foundational to our computers, underpinning most operating systems (OS). Many C-based standard OS include but are not limited to Windows, Linux (nearly entirely in written C), Google Chrome OS, RIM Blackberry OS 4.x, Symbian OS, Apple Mac OS X, iPad OS, Apple, and Cisco IOS [25] . Security recommendations point toward minimizing the usage of C, especially in website development, where security risks are incrementally increased. Despite its shortcomings, C is still a prevalent programming language.

C++ is an all-purpose programming language used for many projects, such as applications, games, browser development, and operating systems [26] . Since C++ is used over such a large spectrum of software programs, it is vital to ensure coding vulnerabilities in C++ do not cause significant security issues. Otherwise, the same basic vulnerabilities can be exploited across a plethora of programs using C++.

PHP is a scripting language mainly used for web development, but it can also be used to make projects such as GUIs or Graphical User Interfaces [27] . Many popular web interfaces use PHP, including Facebook, Wikipedia, and Etsy, among many others [28] .

Many security vulnerabilities originate from an early stage when beginners are taught how to program but not how to code securely. Taylor et al. demonstrated that significant work on SQL injection vulnerabilities shows a surprising lack of concern or discourse around preventative security measures [29] . This lack of education around preventive measures yields a measure of minimizing security concerns and a boom in analysts that create accessible products; websites, applications, and other programs inevitably contain vulnerabilities. Hackers can often easily exploit these vulnerabilities, resulting in data breaches and significant fiscal consequences in the industry.

Furthermore, in recent years, we experienced an explosion in the number of vulnerabilities from 2017 onwards, potentially due to the C++ spike in security issues and applicability [30] . This underscores the importance of secure coding practices, as more vulnerabilities mean more access points for attackers to target.

By exploring the risk of using popular programming languages in everyday computer programs and websites, this research paper what risks are involved in using each language. Furthermore, by identifying the various uses of each language, this paper can help software programmers weigh the advantages and disadvantages of using specific languages for certain tasks.

To recoup, cross-site scripting, or XSS, is a type of cyberattack that occurs when attackers incorporate malicious code into a credible website to attack an unsuspecting user. Vulnerabilities susceptible to XSS can be found very often; according to a Virginia Journal of Science study, more than 60% of web applications are vulnerable to XSS attacks [31] .

XSS is commonly found among the top vulnerability list of leading coding languages. According to the mend.io WhiteSource Report, PHP, Javascript, Java, and Python all feature XSS as one of their top three most common security vulnerabilities [7] . This trend exemplifies XSS’s threat to several websites, as PHP and Javascript are ubiquitous in website development.

Input Validation is a process that involves verifying a user’s input to ensure it follows a set of standards. For example, an input field asking for an email address from the user can verify the user’s input by checking for an “@” symbol and other features. However, this process can sometimes be bypassed. Attackers may also be able to obtain private information. One scenario in which this could happen is when a person orders an item off of a website but inputs an SQL command that fetches the credit card numbers of different people who have previously ordered.

Input Validation is widespread among top coding languages. According to Mend’s WhiteSource Report, the CWE for Input Validation is second-most common in C, Java, and C++ and is most common in Python (when compared to other CWEs) [7] .

SQL Injection is a strategy that attackers use against weak input validation. Attackers can input a malicious SQL string of code into a website, allowing them to access restricted information from databases. In a basic example, attackers could type “SELECT * FROM Users” in a text box to get the elements in the “Users” table.

Mend’s WhiteSource Report ranks SQL Injection as SQL’s second-most common CWE vulnerability [7] . Furthermore, according to research by the internet company Akamai, SQL Injection accounts for over 65.1% of all web application attacks [32] .

Out-of-bounds Write occurs when a program writes data outside a set buffer, causing the program to crash or fail to run. Another name for this is Buffer Overflow. Attackers can take advantage of buffer overflow to crash the program on purpose or cause the program to do what the attacker wants.

According to the CWE website, Out-of-bounds Write ranks first in their 2022 Top 25 Most Dangerous Software Weaknesses list [33] .