Slashdot Mirror

Its far easier to make a call to a command line image manipulation software than to call a library and do all the work yourself.

Not particularly. For instance, with PHP:

• Image manipulation with GD
• Image manipulation with ImageMagick

The originating IPs are *all* assigned to Windows boxes where I could sufficiently NMAP them.

Here's spam server error for pills that supposely will take your sex life to new levels... Guaranteed!

Warning: mysql_connect() [function.mysql-connect]: Host '202.63.201.192' is blocked because of many connection errors. Unblock with 'mysqladmin flush-hosts' in /home/gensoap/html/obg/vars.php on line 25

Warning: mysql_select_db() [function.mysql-select-db]: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) in /home/gensoap/html/obg/vars.php on line 27

Warning: mysql_select_db() [function.mysql-select-db]: A link to the server could not be established in /home/gensoap/html/obg/vars.php on line 27

Warning: Cannot modify header information - headers already sent by (output started at /home/gensoap/html/obg/vars.php:25) in /home/gensoap/html/obg/post.php on line 54

- Almost all Microsof boxes with bad hands that use them!

The originating IPs are *all* assigned to Windows boxes where I could sufficiently NMAP them.

Here's spam server error for pills that supposely will take your sex life to new levels... Guaranteed!

Warning: mysql_connect() [function.mysql-connect]: Host '202.63.201.192' is blocked because of many connection errors. Unblock with 'mysqladmin flush-hosts' in /home/gensoap/html/obg/vars.php on line 25

Warning: mysql_select_db() [function.mysql-select-db]: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) in /home/gensoap/html/obg/vars.php on line 27

Warning: mysql_select_db() [function.mysql-select-db]: A link to the server could not be established in /home/gensoap/html/obg/vars.php on line 27

Warning: Cannot modify header information - headers already sent by (output started at /home/gensoap/html/obg/vars.php:25) in /home/gensoap/html/obg/post.php on line 54

- Almost all Microsof boxes with bad hands that use them!

The originating IPs are *all* assigned to Windows boxes where I could sufficiently NMAP them.

Here's spam server error for pills that supposely will take your sex life to new levels... Guaranteed!

Warning: mysql_connect() [function.mysql-connect]: Host '202.63.201.192' is blocked because of many connection errors. Unblock with 'mysqladmin flush-hosts' in /home/gensoap/html/obg/vars.php on line 25

Warning: mysql_select_db() [function.mysql-select-db]: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2) in /home/gensoap/html/obg/vars.php on line 27

Warning: mysql_select_db() [function.mysql-select-db]: A link to the server could not be established in /home/gensoap/html/obg/vars.php on line 27

Warning: Cannot modify header information - headers already sent by (output started at /home/gensoap/html/obg/vars.php:25) in /home/gensoap/html/obg/post.php on line 54

- Almost all Microsof boxes with bad hands that use them!

It runs on Windows and Unix/Linux so you can stick it on anything So does PHP

Two birds with one stone! This is also a good review of Pear PHP framework.

Can you point me in the direction of some open source tools I can run on my Linux box so I can learn it? Thanks.

Sure thing..

http://php.net/ming
http://www.the-labs.com/PerlFlash/

I'm sure you being the uber-elite open source guru you are, you can google for plenty more.

What does PHP stand for?

PHP stands for PHP: Hypertext Preprocessor. This confuses many people because the first word of the acronym is the acronym. This type of acronym is called a recursive acronym. The curious can visit Free On-Line Dictionary of Computing for more information on recursive acronyms.

source: php.net FAQ

The first P stands for PHP. (PHP: Hypertext Preprocessor).

The point isn't that the data is insecure, or that turning it off will magically make scripts more secure, but the point is users can write code with no clue where the variables are coming from, and this is especially dangerous for newbies. How many newbies initialize variables? Or even validate request data? Not very many. One can write insecure code with it on, and insecure code with it off. And secure code with it on or off. Also turning it off makes your PHP consume much less memory from hundreds of variables that you'll never use.

You should read this:
http://www.php.net/manual/en/security.registerglob als.php

You don't really understand the true argument for the change, or how difficult of a decision it was.

My biggest complaint about PHP is the joke that they pass as "error handling". Yeah great, thanks for exposing all my path names to the outside world if something goes wrong.

Psychic abilities will be added to PHP as of version 6.6.6. From here on you will be able to simply think of the configuration you want and it will be set in php.ini. No longer will you have to read the extremely comprehensive online docs including the manual and especially not the ENTIRE SECTION dedicated to error reporting and logging that tells you extremely clearly how to do what you have just complained is impossible. You would not need to read that page and find the two links within the 1st side that show very clearly information on the display errors, error_log for custom logs and of course log errors to put the errors in the apache logfile.

Your biggest complaint is that you are too lazy to read the manual and you expect everything to be done for you. No programming language can help you with this.

My biggest complaint about PHP is the joke that they pass as "error handling". Yeah great, thanks for exposing all my path names to the outside world if something goes wrong.

Psychic abilities will be added to PHP as of version 6.6.6. From here on you will be able to simply think of the configuration you want and it will be set in php.ini. No longer will you have to read the extremely comprehensive online docs including the manual and especially not the ENTIRE SECTION dedicated to error reporting and logging that tells you extremely clearly how to do what you have just complained is impossible. You would not need to read that page and find the two links within the 1st side that show very clearly information on the display errors, error_log for custom logs and of course log errors to put the errors in the apache logfile.

Your biggest complaint is that you are too lazy to read the manual and you expect everything to be done for you. No programming language can help you with this.

My biggest complaint about PHP is the joke that they pass as "error handling". Yeah great, thanks for exposing all my path names to the outside world if something goes wrong.

Psychic abilities will be added to PHP as of version 6.6.6. From here on you will be able to simply think of the configuration you want and it will be set in php.ini. No longer will you have to read the extremely comprehensive online docs including the manual and especially not the ENTIRE SECTION dedicated to error reporting and logging that tells you extremely clearly how to do what you have just complained is impossible. You would not need to read that page and find the two links within the 1st side that show very clearly information on the display errors, error_log for custom logs and of course log errors to put the errors in the apache logfile.

Your biggest complaint is that you are too lazy to read the manual and you expect everything to be done for you. No programming language can help you with this.

My biggest complaint about PHP is the joke that they pass as "error handling". Yeah great, thanks for exposing all my path names to the outside world if something goes wrong.

Psychic abilities will be added to PHP as of version 6.6.6. From here on you will be able to simply think of the configuration you want and it will be set in php.ini. No longer will you have to read the extremely comprehensive online docs including the manual and especially not the ENTIRE SECTION dedicated to error reporting and logging that tells you extremely clearly how to do what you have just complained is impossible. You would not need to read that page and find the two links within the 1st side that show very clearly information on the display errors, error_log for custom logs and of course log errors to put the errors in the apache logfile.

Your biggest complaint is that you are too lazy to read the manual and you expect everything to be done for you. No programming language can help you with this.

My biggest complaint about PHP is the joke that they pass as "error handling". Yeah great, thanks for exposing all my path names to the outside world if something goes wrong.

Psychic abilities will be added to PHP as of version 6.6.6. From here on you will be able to simply think of the configuration you want and it will be set in php.ini. No longer will you have to read the extremely comprehensive online docs including the manual and especially not the ENTIRE SECTION dedicated to error reporting and logging that tells you extremely clearly how to do what you have just complained is impossible. You would not need to read that page and find the two links within the 1st side that show very clearly information on the display errors, error_log for custom logs and of course log errors to put the errors in the apache logfile.

Your biggest complaint is that you are too lazy to read the manual and you expect everything to be done for you. No programming language can help you with this.

My biggest complaint about PHP is the joke that they pass as "error handling". Yeah great, thanks for exposing all my path names to the outside world if something goes wrong.

Psychic abilities will be added to PHP as of version 6.6.6. From here on you will be able to simply think of the configuration you want and it will be set in php.ini. No longer will you have to read the extremely comprehensive online docs including the manual and especially not the ENTIRE SECTION dedicated to error reporting and logging that tells you extremely clearly how to do what you have just complained is impossible. You would not need to read that page and find the two links within the 1st side that show very clearly information on the display errors, error_log for custom logs and of course log errors to put the errors in the apache logfile.

Your biggest complaint is that you are too lazy to read the manual and you expect everything to be done for you. No programming language can help you with this.

Instead of ODBC, you'd be better off using the pear/db module as middleware. It supports more databases (mysql, odbc, sqlite, pgsql, etc.) and if it isn't the future standard for database access in PHP, something like it will be.

I've been using PHP's built-in (until now) MySQL functions, because they're faster than pear/db, but this licensing dust-up has convinced me that portability among database vendors is worth a performance hit. And the pear/db module is getting increasing attention and is likely to get faster.

I'd say php has already won.

Take it all back.

I looked at the manual and only found this.

That is not good. This module needs some work and does not look too mature.

This blows for people like myself stuck on Windows/Mysql bigtime. I also hate using DB specific function calls. ITs poor programming in my opinion that leads to more work later on and vendor lock in.

likewise, you should read this page

On Sat, 28 Jun 2003, Marc Richards wrote:
> I apologies if this is the wrong place for asking. Is non-experimental
> Apache2 support planned for PHP 5?

Nope. Until someone sits down and goes through every 3rd-party library that can be linked into PHP on every platform and identifies whether or not they are threadsafe and under which conditions they remain threadsafe, using PHP in a threaded web server on UNIX is going to remain experimental.

You can of course stick with non-threaded prefork mode, in which case you basically have Apache-1.3.x. Nobody so far have been motivated to test Apache2-prefork+PHP extensively, so even that combination is going to remain experimental.

The basic problem here is that the average UNIX library has not been written with thread safety in mind. You can write very good specific threaded programs on UNIX, but it is extremely difficult to write something which can potentially link in hundreds of random libraries and expect them to all be threadsafe.

-Rasmus

http://news.php.net/article.php?group=php.internal s&article=%3CPine.LNX.4.56.0306272256280.6461%40th inkpad.lerdorf.com%3E

{joke}

Can Slashdot come up with something better?

Erm, no. Sorry.

{/joke}

$smarty style

Try developing on a MSSQL database with PHP, ASP or PERL and then using an Oracle database in the production enviroment. I have seen this one too many times in my web career. With CF I is a matter of changes 3 variables to accomplish the port. With PHP, ASP and PERL you either have to change a dozen or so functions or classes to accomplish the task.

Have you never looked at PEAR? One class, 10 different databases supported. Just tell it which database you want to connect to, no changing of functions anywhere. I hand roll my own classes (change the included class and it's set for a different DB), probably not as elegant as PEAR's solution, though.

Let's not forget that with one simple tag placed in the application.cfm, I can catch any error that bubbles up on my website, then have that error email me, allowing the user to only see an error page that I designed telling them that the error is being looked at. PHP, ASP and PERL throws the error to the webpage that the user sees. What great security that is!

You didn't get too far with PHP's documentation, then. I can have PHP email me, too, with a complete vardump of every single variable within the page with set_error_handler() or log the error (or log things that technically aren't errors at all) however I want with error_log(). I can tell it exactly how to display the error, and even turn off emailing me and just printing the error out while I debug it so I don't receive 50,000 emails, and have it finish out the rest of the HTML on the page. I can use the trigger_error() to easily display an attractive "you forgot this field" type error message for the user.

Immature? I think not.

Try developing on a MSSQL database with PHP, ASP or PERL and then using an Oracle database in the production enviroment. I have seen this one too many times in my web career. With CF I is a matter of changes 3 variables to accomplish the port. With PHP, ASP and PERL you either have to change a dozen or so functions or classes to accomplish the task.

Have you never looked at PEAR? One class, 10 different databases supported. Just tell it which database you want to connect to, no changing of functions anywhere. I hand roll my own classes (change the included class and it's set for a different DB), probably not as elegant as PEAR's solution, though.

Let's not forget that with one simple tag placed in the application.cfm, I can catch any error that bubbles up on my website, then have that error email me, allowing the user to only see an error page that I designed telling them that the error is being looked at. PHP, ASP and PERL throws the error to the webpage that the user sees. What great security that is!

You didn't get too far with PHP's documentation, then. I can have PHP email me, too, with a complete vardump of every single variable within the page with set_error_handler() or log the error (or log things that technically aren't errors at all) however I want with error_log(). I can tell it exactly how to display the error, and even turn off emailing me and just printing the error out while I debug it so I don't receive 50,000 emails, and have it finish out the rest of the HTML on the page. I can use the trigger_error() to easily display an attractive "you forgot this field" type error message for the user.

Immature? I think not.

Try developing on a MSSQL database with PHP, ASP or PERL and then using an Oracle database in the production enviroment. I have seen this one too many times in my web career. With CF I is a matter of changes 3 variables to accomplish the port. With PHP, ASP and PERL you either have to change a dozen or so functions or classes to accomplish the task.

Have you never looked at PEAR? One class, 10 different databases supported. Just tell it which database you want to connect to, no changing of functions anywhere. I hand roll my own classes (change the included class and it's set for a different DB), probably not as elegant as PEAR's solution, though.

Let's not forget that with one simple tag placed in the application.cfm, I can catch any error that bubbles up on my website, then have that error email me, allowing the user to only see an error page that I designed telling them that the error is being looked at. PHP, ASP and PERL throws the error to the webpage that the user sees. What great security that is!

You didn't get too far with PHP's documentation, then. I can have PHP email me, too, with a complete vardump of every single variable within the page with set_error_handler() or log the error (or log things that technically aren't errors at all) however I want with error_log(). I can tell it exactly how to display the error, and even turn off emailing me and just printing the error out while I debug it so I don't receive 50,000 emails, and have it finish out the rest of the HTML on the page. I can use the trigger_error() to easily display an attractive "you forgot this field" type error message for the user.

Immature? I think not.

Try developing on a MSSQL database with PHP, ASP or PERL and then using an Oracle database in the production enviroment. I have seen this one too many times in my web career. With CF I is a matter of changes 3 variables to accomplish the port. With PHP, ASP and PERL you either have to change a dozen or so functions or classes to accomplish the task.

Have you never looked at PEAR? One class, 10 different databases supported. Just tell it which database you want to connect to, no changing of functions anywhere. I hand roll my own classes (change the included class and it's set for a different DB), probably not as elegant as PEAR's solution, though.

Let's not forget that with one simple tag placed in the application.cfm, I can catch any error that bubbles up on my website, then have that error email me, allowing the user to only see an error page that I designed telling them that the error is being looked at. PHP, ASP and PERL throws the error to the webpage that the user sees. What great security that is!

You didn't get too far with PHP's documentation, then. I can have PHP email me, too, with a complete vardump of every single variable within the page with set_error_handler() or log the error (or log things that technically aren't errors at all) however I want with error_log(). I can tell it exactly how to display the error, and even turn off emailing me and just printing the error out while I debug it so I don't receive 50,000 emails, and have it finish out the rest of the HTML on the page. I can use the trigger_error() to easily display an attractive "you forgot this field" type error message for the user.

Immature? I think not.

if you want a rewarding experience with programming for the first or second time.. i cant recommend something like PHP enough.
<p>
because you can do all the interface stuff in html it makes getting something worthy of showing mum really easy to make.

One of the best documented and easiest languages I've ever seen.

Or, not so great docs, but a much better (if not yet as featureful) language.

Ok, I'll bite. I'm not a PHP expert, but I think I can respond to a few of these statements.
3. Huh? I don't do this when I add a module. ???
5. There is a debugger. And here.
8. There is a free PHP Accelerator for non-Windows boxes.

Just my two cents.

1 - It lets you mix html and code in. Sure, it's not the only language that lets you do it, but it's still a strength.

I thought that PHP did a great job of mixing HTML and code until my PHP apps started reaching a certain size. Even using function calls and classes, templates started getting convoluted. Then I discovered Smarty and my whole way of working changed. Smarty is a template manager that allows for more precise separation of content and code. As a super-simple example, lines like become {$variable}. Over the course of a whole site, the savings from this syntax alone ease code readability (yes i care about such a thing). But there's a lot more to smarty than shorter variables, including shorthand for string modifiers and loops, as well as a nifty caching system that can speed up dynamically generated sites, and zillions of other really cool things for "lazy" programmers like me.

A lot of people on this thread have mentioned AdoDB (my other favorite PHP add-on), but I haven't seen anyone give a proper shout out to Smarty. It's made my life easier.

Quotes in PHP do work in a sane and consistent way, very similar to the way they work in PERL. The only thing I mourn is the lack of a qq[-like facility (and I wouldn't be surprised if someone snuck it in while I wasn't looking, and I just didn't know about it).

Not yet, AFAIK, but you can always use the heredoc syntax to achieve the same effect -- the only problem is that the heredoc terminators kind of disturb your indentation. Still very useful for large string literals....

1) consistant database integration - Why not have a SetDBType() function, rather than hardcoding mysql_connect, mssql_connect, myodbc_connect, pgqsl_connect, etc?

Because different databases do different things, and abstracting degrades performance -- you CAN, however use ODBC with PHP. I do abstract whenever time allows. Manual abstraction is easy. There's a DB:: class in PEAR as well as ADOdb.


2) Native XML support - It's just not there? Why re-invent the wheel each time? Give us a good XML tree-walking engine DAMMIT!


php.net/xml


3) sane and consistant functions. Single quotes, double quotes, some functions work with both, some work with one or the other, embedded html in an echo screws up if you don't double quote it, etc.


Quotes always work consistently. If you're thinking of Magic Quotes, it's a "feature" put there to make newbies not do stupid things. It can be turned off, and worked around very easily. I will, however, give you that function naming could use an overhaul, but in order to save backwards compatibility, this has not been done. The parameter order of implode vs. substr is confusing, and easy to forget.


4) .NET support?

This might not be exactly what you're looking for, but the January issue of PHP Architect has an article on using PHP with the .NET framework.

Enjoy. PHP is not all things, but it does a GOOD job on the web.

S

1) consistant database integration - Why not have a SetDBType() function, rather than hardcoding mysql_connect, mssql_connect, myodbc_connect, pgqsl_connect, etc?

Because different databases do different things, and abstracting degrades performance -- you CAN, however use ODBC with PHP. I do abstract whenever time allows. Manual abstraction is easy. There's a DB:: class in PEAR as well as ADOdb.


2) Native XML support - It's just not there? Why re-invent the wheel each time? Give us a good XML tree-walking engine DAMMIT!


php.net/xml


3) sane and consistant functions. Single quotes, double quotes, some functions work with both, some work with one or the other, embedded html in an echo screws up if you don't double quote it, etc.


Quotes always work consistently. If you're thinking of Magic Quotes, it's a "feature" put there to make newbies not do stupid things. It can be turned off, and worked around very easily. I will, however, give you that function naming could use an overhaul, but in order to save backwards compatibility, this has not been done. The parameter order of implode vs. substr is confusing, and easy to forget.


4) .NET support?

This might not be exactly what you're looking for, but the January issue of PHP Architect has an article on using PHP with the .NET framework.

Enjoy. PHP is not all things, but it does a GOOD job on the web.

S

1) consistant database integration - Why not have a SetDBType() function, rather than hardcoding mysql_connect, mssql_connect, myodbc_connect, pgqsl_connect, etc?

Because different databases do different things, and abstracting degrades performance -- you CAN, however use ODBC with PHP. I do abstract whenever time allows. Manual abstraction is easy. There's a DB:: class in PEAR as well as ADOdb.


2) Native XML support - It's just not there? Why re-invent the wheel each time? Give us a good XML tree-walking engine DAMMIT!


php.net/xml


3) sane and consistant functions. Single quotes, double quotes, some functions work with both, some work with one or the other, embedded html in an echo screws up if you don't double quote it, etc.


Quotes always work consistently. If you're thinking of Magic Quotes, it's a "feature" put there to make newbies not do stupid things. It can be turned off, and worked around very easily. I will, however, give you that function naming could use an overhaul, but in order to save backwards compatibility, this has not been done. The parameter order of implode vs. substr is confusing, and easy to forget.


4) .NET support?

This might not be exactly what you're looking for, but the January issue of PHP Architect has an article on using PHP with the .NET framework.

Enjoy. PHP is not all things, but it does a GOOD job on the web.

S

1) consistant database integration - Why not have a SetDBType() function, rather than hardcoding mysql_connect, mssql_connect, myodbc_connect, pgqsl_connect, etc?

Because different databases do different things, and abstracting degrades performance -- you CAN, however use ODBC with PHP. I do abstract whenever time allows. Manual abstraction is easy. There's a DB:: class in PEAR as well as ADOdb.


2) Native XML support - It's just not there? Why re-invent the wheel each time? Give us a good XML tree-walking engine DAMMIT!


php.net/xml


3) sane and consistant functions. Single quotes, double quotes, some functions work with both, some work with one or the other, embedded html in an echo screws up if you don't double quote it, etc.


Quotes always work consistently. If you're thinking of Magic Quotes, it's a "feature" put there to make newbies not do stupid things. It can be turned off, and worked around very easily. I will, however, give you that function naming could use an overhaul, but in order to save backwards compatibility, this has not been done. The parameter order of implode vs. substr is confusing, and easy to forget.


4) .NET support?

This might not be exactly what you're looking for, but the January issue of PHP Architect has an article on using PHP with the .NET framework.

Enjoy. PHP is not all things, but it does a GOOD job on the web.

S

1. PHP does have a consistent database interface
2. PHP does have native XML support
3. Single-vs-double quoting is consistent, and acts like many other scripting languages
4. Preliminary .NET support is available already.

There are legitimate criticisms of PHP, but these aren't them.

1. PHP does have a consistent database interface
2. PHP does have native XML support
3. Single-vs-double quoting is consistent, and acts like many other scripting languages
4. Preliminary .NET support is available already.

There are legitimate criticisms of PHP, but these aren't them.

1. PHP does have a consistent database interface
2. PHP does have native XML support
3. Single-vs-double quoting is consistent, and acts like many other scripting languages
4. Preliminary .NET support is available already.

There are legitimate criticisms of PHP, but these aren't them.

1. PHP does have a consistent database interface
2. PHP does have native XML support
3. Single-vs-double quoting is consistent, and acts like many other scripting languages
4. Preliminary .NET support is available already.

There are legitimate criticisms of PHP, but these aren't them.

I wonder because I started in ASP with VBScript. I learned Perl and PHP and now I do PHP pretty much full time.

I followed pretty much the same path as you, and once I tried PHP there was no turning back, especially once I discoverd the Smarty Template Engine. Everyone doing PHP development should check it out.

PHP has reflection...

An entire chapter in the manual for it.

I'm pretty sure this is a troll (I mean, .NET support?), but since it's had a large amount of "Insightful" mods, I figured I would point out at least one misconception.

The parent poster complains about "consistant (sp) database integration" as one of the main problems with PHP. This is usually a problem noted only by those who haven't used PHP in serious development. Sure, if you're writing a 20-line script that you know is only going to use MySQL, then who cares what database connection statements you're using. However, if you're writing anything that needs to be more serious and portable, check out one of PHP's database abstraction libraries: ADOdb or Pear DB. Both of these libraries will let you abstract out database functions so that they aren't tied to one specific database.

Personally, I prefer ADOdb. Not only is it faster than Pear DB, but there's also a C port to speed it up even more. ADOdb also has more capabilities, and its author hangs out in their forums and is extremely helpful with user questions.

You have to change your mindset a bit to code with ADOdb or Pear DB, but it's worth the bit of extra learning curve to gain portability. Since ADOdb can generate insert/update SQL and also generate HTML tables, I find that I'm faster coding with it than I ever was with mysql_query()... and I can switch to Postgres or Microsoft SQL Server at any time without really thinking about my database code.

I hope this helps those of you who are still stuck with mysql_query() or similar. <plug>Also, we're a web hosting company that supports PHP 4.3.x, ADOdb and Pear DB, and we will answer your PHP questions as part of your web hosting package.</plug>

1) consistant database integration - Why not have a SetDBType() function, rather than hardcoding mysql_connect, mssql_connect, myodbc_connect, pgqsl_connect, etc?

I believe there is a PEAR package that abstracts an OO layer over the functions to various databases. Think DBI for PHP.

2) Native XML support - It's just not there? Why re-invent the wheel each time? Give us a good XML tree-walking engine DAMMIT!

Natvie XML support is there. A SAX parser is usually built in by default. I'm happily using a DOM XML interface that I compiled into my version.

3) sane and consistant functions. Single quotes, double quotes, some functions work with both, some work with one or the other, embedded html in an echo screws up if you don't double quote it, etc.

Quotes in PHP do work in a sane and consistent way, very similar to the way they work in PERL. The only thing I mourn is the lack of a qq[-like facility (and I wouldn't be surprised if someone snuck it in while I wasn't looking, and I just didn't know about it).

4) .NET support?

Um.... why?

One thing I would like to see more PHP books do is to cover the various Security problems that are prevalent in many PHP based web applications.

I completely agree with you. David Sklar (one of the authors of the book reviewed here) gave a very interesting presentation about the subject of security in web applications at the International PHP Conference (May 2003) in Amsterdam. You can view the slides of his talk here.

JP

I've been doing PHP web development on and off for a couple of years now and I've always found that it's greatest strength has been the availability of very god online resources.

PHP.net and many other excellent resources are only a browser click away and remain up to date for free. PHP is one of those areas where I'll save my money and buy a book I'll get genuine reference use from.

in a real OO language is to use a class attribute

kinda like a reference to your database object, or any other object inheriting from it. Then to call $this->db->query(). You could possibly even just include() the db class and db::query() from your object as php will use the same mysql connection as the poster above mentioned.

you have to use global variables

Not always, thats just one way. Each update to PHP brings changes such as tighter variable types and enforcing the syntax more, imo its maturing into a nice language and PHP 5 should be interesting.

For websites that is... :)

I'm a reasonably experienced Java developer (4 years). We're mostly creating J2EE applications at my work.

Recently I had to work in PHP as well; a friend of mine wanted a small website. It was quite a change!

I know Java has its drawbacks, but the tooling is becoming really good: Eclipse, code beautifiers, Javadoc, Junit, StrutsTestCases, Hibernate ... they all make developing a lot easier.

Tooling for PHP is another matter. There are editors, there are Eclipse plugins, but nowhere near the level of Java (or, of course, Visual Studio for that matter). It seems like all the tools are just a bit less mature (perhaps with the exception of database-access layers, there are quite good ones available). A point where PHP beats Java is of course deployment: simply change the source file, reload the page, and your application is deployed. That takes a bit longer in Java ;)

However, tooling isn't the most important thing for a good system: the design is what really matters. This is not made easier by the lack of decent OO functionality of PHP. My approach was to stick with the 'Struts-way' as much as possible.

There's a reasonable Struts-replacement (Phrame), which works pretty neat with the template engine Smarty.

The project worked well -- but I'm happy to be back at Java. Somehow programming in PHP felt a bit 'ugly'. Although the code is quite readable, and the application works nicely, I don't have the same proud feeling I (sometimes :)) have when writing Java code.

Don't know if it's an option, but I saw quite decently priced Java hosting: http://www.4java.ca/ (no personal experience with them though).

Check out phplib. I used it a lot back in the days when I was a php monkey :) Really loved it. I fumbled a lot with the templates implementation, which I didn't really like, anyway, any sane person would use php's xslt functions for that now.

I'd recommend looking at the PEAR Coding Standards. I find that most of the styles of coding that I developed on my own are similar. I changed a few of my habits to conform with PEAR's standard. I don't necessarily ever plan on submitting code to the project, but I like to have a written rule and it's a decent rule, fwiw. Personally, I would like to see these guidelines adopted as industry-standard php coding style, but whatever.

So, yeah, check that out.

Why avoid OOP? PHP supports classes.

Granted, it isn't Java, but that isn't any reason to avoid them altogether or to avoid the tremendous amount of benefit that can be obtained from one.

jason@php.us