What is a LAMP system, where does it usually sit, and why is it tied to the history of web application firewalls?

Question

Accepted Answer

LAMP stands for Linux, Apache, MySQL, PHP: a very widespread way to build websites, available as packages for practically every relevant operating system, with variants such as PostgreSQL instead of MySQL or Python instead of PHP. LAMP systems are typically placed in a DMZ. They appeared in masses during the dot-com boom and e-commerce hype of the 2000s, and their massive security problems drove the development of WAF technology.

* Four layers, each with its own patches and its own vulnerabilities. *
Each letter is a separate component: the Linux operating system, the Apache web server, the MySQL database and the PHP scripting language that builds the pages. That made it cheap and quick to put a shop or portal online, and many were written fast by small teams with little security knowledge. Unchecked form input led to SQL injection and cross-site scripting on a huge scale. Fixing thousands of individual applications was slow, so the industry put a filter in front of them instead: the WAF, which checks requests for known attack patterns before they reach the application (the open-source ModSecurity project started in 2002 for exactly this).
Go deeper:

LAMP (software bundle) — Wikipedia — the components, the variants and how the stack spread.
 Web application firewall — Wikipedia — history from the first products to ModSecurity and the OWASP Top 10.
 Dot-com bubble — Wikipedia — the boom in which these systems were built in masses.