Slashdot Mirror


A Decade of PHP

digidave writes "It was slow to catch and a lot of people didn't get it. A lot of people still don't get it, but you can't argue with its success. June 8th, 2005 marks the tenth anniversary of PHP. Here's to ten more wonderful and exciting years."

76 of 452 comments (clear)

  1. Congratulations are in order! by AKAImBatman · · Score: 3, Insightful

    Congrats to the PHP development team! PHP has long followed the KISS principle while still maintaining the Unix APIs that we've all learned to know and love. While it's not the best web scripting platform for all purposes, it is a free and flexible alternative for many, many dynamic webpage projects. It's only because of PHP that so many OSS web applications have been allowed to exist.

    It was slow to catch and a lot of people didn't get it.

    Ok, I'm with the slow-to-catch-on part, but what's this about people not getting it? The concept had to be one of the simplest ever designed. (Thus the reason why it's so common across web scripting languages.) Here is your HTML, here's a bit of Unix scripting langauge. Simple, see? :-)

    On a slightly different topic, one wishlist item that I would like to see in PHP is Abstract Database Access. It's not really a good thing to hard code your application to a specific database, especially if it's a redistributable application. (e.g. PHPBB) The ODBC calls sort of solve this, but they do require that ODBC is installed, properly configured, and compiled into your copy of PHP. (Does anyone know if any distros now have ODBC as a "standard" library?) This assumption can't be made for most OSS applications, so they tend to tell you to just use MySQL.

    1. Re:Congratulations are in order! by quinto2000 · · Score: 5, Informative

      there are several classes, including the PEAR DB class, that provide a DB abstraction layer.

      --
      Ceci n'est pas un post
    2. Re:Congratulations are in order! by Ford+Prefect · · Score: 2, Funny

      On a slightly different topic, one wishlist item that I would like to see in PHP is Abstract Database Access.

      Actually, what I'd like to see is bitwise-operations on strings - my Ogg Vorbis decoder written in PHP is currently languishing at just a bare-bones Ogg demuxer 'cos unpacking all the Vorbis packets proved just too fiddly...

      --
      Tedious Bloggy Stuff - hooray?
    3. Re:Congratulations are in order! by AKAImBatman · · Score: 5, Informative

      Dude, you need to provide links. I had to *gasp* Google it! ;-)

      For others, PEAR can be found here:

      PEAR Class Repository

      The Database classes of PEAR appear to be documented here:

      Database Package

      Looking over the DB classes, it looks like they provide a fairly decent abstraction. Thanks Quinto, that will definitely be nice for future PHP projects. :-)

    4. Re:Congratulations are in order! by EraserMouseMan · · Score: 2, Insightful

      It's not really a good thing to hard code your application to a specific database

      For most simple apps (90% of what PHP apps are) you should stick with SQL-92 syntax when you write your queries. Then just write yourself some generic functions that you pass your query and a connection string to. The functions determine the db-specific query execution code to use. I always use parameterized queries. So I've even got functions to switch the parameter character ('?' or '@' etc) to the syntax of the target db. For my apps, all I have to do is change the connection string (currently supports, MySql, Sql Server, any Odbc and any OleDb). No query or code changes required necessary.

      But yea, it'd be nice if this functionality was native.

    5. Re:Congratulations are in order! by AKAImBatman · · Score: 4, Insightful

      You wrote an OGG Vorbis decoder in PHP? Maybe I'm missing something, but why? That doesn't strike me as a very good language to be doing such a thing in. The "PHP Way" is to leave heavy processing like that to an external library such as libogg/libvorbis. You can then use PHP as a frontend for presenting info, streaming the data, and uploading files.

      I realize that PHP can be cool at times, but one has to use the right tool for the job at hand. :-)

    6. Re:Congratulations are in order! by rho · · Score: 4, Interesting
      I've never understood the fanaticism of database abstraction. There's good reason to hardcode to a specific database, especially if you hardcode to a Free database like PostgreSQL.

      For example, if you use a database abstraction, you have to make a lot of performace- or feature-robbing choices. There are still hosting situations where MySQL is still on 3.23, so you can't use the better parts of the InnoDB storage engine. So no foreign key constraints, no stored procedures.

      On the other hand, if you do hardcode for PostgreSQL, you put a burden on the end user, sure--but in return, you're giving them a more robust, more featureful application that is easier to support and maintain. I personally like PostgreSQL because it seems less haphazard than MySQL, but you could very easily do this with MySQL, so long as you restrict yourself to the later, non-crippled versions.

      The Arsdigita folks did this with Oracle. Leaning on a $tens-of-thousands database application may put you out of the realm of everyday developers, but it's far from insane.

      This is "all the time I've spent dealing with other people's code that doesn't have a foreign key to be found and all integrity checking is done in the PHP code" talking. It's infuriating.

      --
      Potato chips are a by-yourself food.
    7. Re:Congratulations are in order! by AKAImBatman · · Score: 3, Interesting

      I completely agree. The primary reason why native code would be nice is that a bundled API would help put peer pressure on coders to use it. Which means that we'd see fewer "quick hacks/prototypes" (that always turn into production sites) using database specific code.

    8. Re:Congratulations are in order! by AKAImBatman · · Score: 2, Informative

      You can easily code your SQL to be database specific if you need it that way, but that shouldn't in any way stop developers from using a generic DB access API. A DB abstraction is nothing more than a mapping of functions, so there's rarely any performance hits. Which means that applications that don't need a specific database (e.g. PHPBB anyone?) could be portable out of the gate. And even if their SQL isn't portable, that's a far easier thing to fix than attempting to add a DB abstraction after the fact.

    9. Re:Congratulations are in order! by mcrbids · · Score: 2, Insightful

      Hear here!

      I've never understood the fanaticism of database abstraction. There's good reason to hardcode to a specific database, especially if you hardcode to a Free database like PostgreSQL.

      You took the words right outta my mouth. I tend to work on large projects, usually the app has its own server (or servers) to work on.

      I've hard-coded to Postgres since 7.0 came out, and I've NEVER regretted it. The only problem I've had is when one of my clients demanded "cross-platform".

      I had more problems with that sucker than with three others combined. Since I couldn't assume subselects, there was lots of parsed queries that resulted in additional bugs, etc.

      Pick a platform, then use it. If the platform is truly free, you aren't "locking" anybody at all, are you?

      --
      I have no problem with your religion until you decide it's reason to deprive others of the truth.
    10. Re:Congratulations are in order! by Just+Some+Guy · · Score: 3, Insightful
      If you think that "PHP" and "KISS" belong in the same sentence (without a negation operator), then you're nuts. Having separate functions (in the main namespace, no less!) for every possible way you might want to sort a list is not simple, reasonable, or the standard accepted way of doing such things.

      When you can explain the core language and primary namespace to an interested programmer in under 30 minutes, I'll be glad to revisit the topic. Until then, Python is simple. Perl is even reasonable simple. PHP is not simple in any way, shape, or form (unless you're using the facetious Simple from SMTP, SNMP, and other horridly complex standards).

      --
      Dewey, what part of this looks like authorities should be involved?
    11. Re:Congratulations are in order! by rho · · Score: 2, Insightful

      Good points in your reply. Thanks for that.

      If I was interviewing someone and they presented me with sample code riddled with "pg_connect()" calls rather than abstracting that into its own library, my first question would be "tell me why it is bad to do this."

      Well, it all depends, doesn't it?

      First, there's a difference between coding an abstraction layer that facilitates interaction with your database, and coding an abstraction layer that handwaves away the peculiarities of any particular database. For example, if you have a function called "get_data_from_postgres_and_format_table()", that's an example of the first situation. Another way to do it that follows the second would be "format_table(get_data())", where the gathering of data from a database is generalized across databases, and the formatting of tables is done as a function of the application.

      In other words, putting all those "pg_connect()" calls behind something that helps you develop your application faster is a good thing. However, it does not neccessarily follow that then formalizing a set of database calls that dissolves the differences between PGSql and MySql and Interbase is also a good thing.

      I can use Drupal as an example, since I know it fairly well. The "Node" is the basic structure of the framework, and modules that extend the basic node must have the same ID as the node base. When presented, the node is a JOIN of the primary node and the extended node's tables. In Drupal, the work coordinating these is done by having, conceptually, a "get_me_the_next_node_id_number()" function and preventing future calls from grabbing that same number. This is all done in PHP, rather than simply saying, "Inser this and that in table 1 and table 2, and make table 2's ID equal table 1's ID."

      My arguments also do not apply to a good 75-80% of Web-based applications, most of which simply use the database as a less-dangerous way of accessing and storing data in the filesystem. They would be equally well-served by flatfiles, but don't because of the security issues inherent in allowing a Web server process to write to the filesystem. I'm not terribly familiar with PHPBB, but I imagine that there are multiple workarounds hand-hacked in PHP to accomodate those folks whose MySQL wouldn't know a foreign key from a stored procedure. All of these things introduce bugs, performance issues, and maintainability issues just as severe as any dependance on a single database vendor does--they're just different.

      I recognize that there are problems inherent in dealing with, say, PostgreSQL, but those do not go away with database abstraction. All database engines will have some level of maintenance issues--the benefit from depending on a single database is that you can codify the procedures in your documentation and maybe even your code--a cron-run script that automatically VACUUMs the database at 2:30AM--rather than weaseling out with a "The care and feeding of your database is beyond the scope of this document" disclaimer.

      Finally, this really only applies to larger PHP projects. I've found that when PHP is used to do something quick-and-dirty, it's almost always hard-coded to whatever database the programmer happens to have. It's only when that quick-and-dirty program starts to become popular does everybody clamor for "database independence", and then the author will comply. So, as an application grows in features and complexity, rather than leaning on the database to do it's job, the programmer doubles his work by re-inventing ideas, and re-learning mistakes, that database vendors dealt with 10 years ago, such as concurrency and performance issues. So, ironically, the best design decisions are made when it was just a little hack, and "creeping CS-isms" strike it as it gets more widely used, crippling the speed at which development can take place.

      --
      Potato chips are a by-yourself food.
    12. Re:Congratulations are in order! by cvd6262 · · Score: 2, Insightful

      Why climb to the top of a mountain when a helicopter is clearly the correct tool for that job?

      --

      I'd rather have someone respond than be modded up.

    13. Re:Congratulations are in order! by jadavis · · Score: 2

      There are reasons for database-specific code: not all databases are the same.

      The "lowest common denominator" data storage/retrieval does not actually mean you can use your database like a Relational Database Management System.

      If you don't want your database to do what Relational Database Management Systems do, and you're just going to use it for flatfile-like queries, why not just use SQL-Lite? SQL-Lite has familiar syntax, but can be bundled with the application. You don't have to worry about what database the user has installed.

      If you want a RDBMS, get a good one, and code specifically for it if you want. It will save a huge amount of application code. The ideal application does not redesign all of the features that it needs at the application level just to achieve the mystical "db-agnosticism". The ideal application design says: "These features already work in my database. I'm going to use my database."

      --
      Social scientists are inspired by theories; scientists are humbled by facts.
    14. Re:Congratulations are in order! by melstav · · Score: 2, Informative

      Well, maybe for the same reason that This guy wrote a webserver using Postscript.

  2. What's not to get? by Enigma_Man · · Score: 2, Insightful

    Seriously, honest question. What's not to get about a language? It's just another language with different options, styles, formats, and uses...

    -Jesse

    --
    Nothing says "unprofessional job" like wrinkles in your duct tape.
    1. Re:What's not to get? by ajs318 · · Score: 2, Informative

      REGISTER_GLOBALS is not insecure. The default order of fetching -- cookies overwrite sessions, POSTs overwrite cookies, query strings overwrite POSTs -- is potentially insecure. Somebody could use a URL something like http://myisp.co.uk/~myspace/foo.php?auth=1 and, if you just relied on the value of $auth without regard to where $auth was coming from, you might get hurt.

      It did say in the manual that this would happen and how to get at the different data sources if you cared. {And you can do sneaky stuff of your own, like if ($_GET["auth"]) { include "crash_browser.inc.php"; exit(); }; if you really want}.

      Often, you don't really care where your data is coming from anyway. I personally would have had POSTs overwrite query strings, cookies overwrite POSTs and sessions overwrite cookies. That would have dealt with it even more simply -- though it probably would have made debugging a 'mare.

      --
      Je fume. Tu fumes. Nous fûmes!
  3. Good for them. by Willy+on+Wheels · · Score: 4, Funny

    I have been an avid user of php, I have even made my own website using PHP. It is so good that big sites such as mine use it. For all serious developers, PHP is the best choice for all php programming.

    --
    Do you play with your Willy?
    1. Re:Good for them. by generationxyu · · Score: 5, Funny
      PHP is the best choice for all php programming.

      You're absolutely right. I tried to do my PHP programming in BASIC once. Bad idea.

      --
      I mod down pyramid schemes in sigs.
  4. I don't really like PHP that much... by Anonymous Coward · · Score: 3, Insightful

    What is so exciting about it? I can't find a single situation where it is better to use PHP than other programming languages. Why would anyone love PHP?

    1. Re:I don't really like PHP that much... by sffubs · · Score: 2, Insightful

      PHP is good because it's easy. It might often not be the most sophisticated, structured, or easily maintained language, but it is often the quickest and simplest solution to a problem. In that respect it fills an important niche.

      --
      ݼ)s$æúßðíÊ'öX'îò5^àûßQç£
    2. Re:I don't really like PHP that much... by Anonymous Coward · · Score: 2, Insightful

      Amateur programmers, mostly.

      If you don't know a damn thing about web apps, PHP is easy to use and has a big community.

      *shrug* I think PHP is an awful awful language.

      The choices for function names, the global variables, the terrible value/reference confusion (still present in PHP5), the Java-like cruft, the lack of any decent metaprogramming facilities, the php.ini which means every installation is potentially different...ug. What a headache.

  5. Re:First AC by AKAImBatman · · Score: 4, Informative

    What the hell is PHP?

    Probably a troll, but just in case anyone else doesn't know: PHP is a scripting language designed for generating dynamically created web pages. It functions by mixing its scripting in with the HTML, thus allowing programmers to reuse existing page designs. The scripting APIs are centered around those commonly used on Unix systems. PHP is usually bundled with Apache, so no installation tends to be required.

    PHP Homepage

  6. Congratulations PHP by GnuVince · · Score: 5, Funny

    You've done such a wonderful job that it's time you stop now and let something better take over :)

    1. Re:Congratulations PHP by Black+Perl · · Score: 4, Insightful

      isn't language bigotry a pretty old joke by now

      You're one of those people who don't get it. This is not a language issue. In the not-so-distant future, developers will think it crazy not to use an MVC web framework for their web applications.

      Ruby on Rails just happens to be first with an elegant, easy-to-use, true-separation-of-concerns, MVC web application platform.

      The Java, Python, and Perl (Catalyst) folks have seen the light and are busy working on Rails-style frameworks. Seems like the PHP community hasn't seen the need yet.

      --
      bp
    2. Re:Congratulations PHP by Peter+Cooper · · Score: 2, Insightful

      I consider this a good thing. The RoR community is of a decent size where development is moving on at a steady pace and documentation is, mostly, plentiful.. but not big enough that you're flooded with thousands of third-world developers coding at 10 cents a line. Not that the third-world developers are a particular problem.. people who think they can code in the West are also a major problem as they tend to quote peanuts and end up costing their customers big time.

    3. Re:Congratulations PHP by rho · · Score: 3, Insightful
      n the not-so-distant future, developers will think it crazy not to use an MVC web framework for their web applications.

      You know, I heard the same thing about Java back in 1996 or so.

      Don't get me wrong, Rails looks decent enough, but neither is it a panacea. You can put together a really fast RSS reader, or a DB-backed recipe application, but these are trivial applications. Solving trivial problems elegantly isn't worthless, but thus far I haven't seen any Rails projects that compare in scope to something like Zope, or Drupal or even PHPBB.

      Going through the various How-Tos for Rails, I keep saying to myself, "...or, I could just download foo, which is written in Perl/PHP/Python/AWK, but already works and is proven and does the same thing." PHP hasn't seen the need for copying Rails because they have a robust and featureful set of applications already. Dropping everything and chasing the next sexy thing might be entertaining, but it doesn't do much to help me, the working Webmaster.

      I guess I'm just suspicious of using MVC (or OOP, or some other trendy buzzword) as a talisman. It smacks of cheerleading, and accusing people of "not getting it" doesn't prove the point.

      --
      Potato chips are a by-yourself food.
  7. PHP vs JSP by SamSeaborn · · Score: 5, Interesting
    Congrats to PHP for its success, but I'm one of those who doesn't get it.

    I tried PHP, but I didn't feel it gave me the rigid OO structure and sophisticated APIs I get from Java, JSPs & Servlets.

    Not trolling, just saying I'm surprised that Java and Servlet hosting isn't as popular as PHP. I'm obviously missing some key point.

    Sam

    1. Re:PHP vs JSP by Frymaster · · Score: 5, Insightful
      I tried PHP, but I didn't feel it gave me the rigid OO structure and sophisticated APIs I get from Java, JSPs & Servlets.

      but procedural is a valid way to structure your apps... especially for web-based ones where that have, by nature, a page-based model and a very linear flow. you can write serious software using php4 without oop!

    2. Re:PHP vs JSP by NardofDoom · · Score: 4, Insightful

      The key point you're missing is that PHP doesn't have a rigid OO structure, which is why it's popular, especially for web scripting. People don't want rigid structures if they just want to throw a page together. It also is integrated well with Apache and uses similar control functions to C/C++, so programmers can switch between the languages easily.

      --
      You have two hands and one brain, so always code twice as much as you think!
    3. Re:PHP vs JSP by xannik · · Score: 3, Informative

      I think the main reason is that OO is just not important when writing simple scripts that are taking information say from an HTML form and inputting into a database or some other simple yet highly used task. Most people that are using PHP on a shared hosting provider will probably not need to use any OO features. Now, the PEAR project for PHP does provide good abstraction for the language and I think makes PHP a much more usable system for higher end projects. I guess what I am trying to say is that for the common joe PHP is simple and gets the job done and if there is an easy way to do something normally people will flock to that solution. And I also think that PHP as of version 5 has become a much more mature option for even high end companies.

      --

      Go Illini!!!
    4. Re:PHP vs JSP by Neil+Watson · · Score: 2, Insightful

      The lack of rigid structure and thowing a page together are the very things make PHP a potentially dangerous language. When in the right hands PHP is a good tool. However, it does allow for sloppy work.

    5. Re:PHP vs JSP by ajs · · Score: 4, Insightful

      quoth Frymaster, "procedural is a valid way to structure your apps... especially for web-based ones where that have, by nature, a page-based model"

      This is my basic gripe with PHP. It leads the unfortunate user down a path that suggests that each page is its own island, and any attempt to modularize or componentize that is, by PHP's nature, a secondary affair.

      Take, as a counterpoint, something like TTK. Here, you are presented with a programming langauge in which you write your code, and a templating system in which you write pages for display and a set of tools for connecting the two.

      It's not that a good programmer can't produce a workable system in PHP alone or PHP + other langauges (PHP backed by Perl or Java or C# is quite powerful, in fact), it's just that it seems that the majority of people writing PHP are hobbled by this unfortunate presentation of the language as a "page generator", and thus most of the code written in PHP is rewrite-fodder from day one.

      As a templating system, PHP is quite nice, and I'd use it where appropriate.

    6. Re:PHP vs JSP by njcoder · · Score: 2, Funny

      filthy bar wenches no doubt

  8. Thanks for the career, PHP!! by ylikone · · Score: 5, Insightful

    I've made my living for the past 3 years as an independent PHP developer. I don't care what anybody thinks of PHP, it makes me money to live.

    --
    Meh.
    1. Re:Thanks for the career, PHP!! by downward+dog · · Score: 4, Insightful

      The poster makes a valid point: PHP is a marketable language. Whether it is good or bad, perfect or not, it gets the job done for some people. Myself included. I'll give Ruby a chance someday, but for now, PHP keeps my clients happy.

  9. Student Suspended Over Suspected Use of PHP by Conspiracy_Of_Doves · · Score: 5, Funny
  10. One of pillars of success: manual by Pecisk · · Score: 5, Insightful

    Yes, that simple thing which is overused for learning and coding pratices. In the times when you are have to look for good perl manual, PHP manual from the very begining was perfect. That's it. And second best thing came when they added those comments for user experience.

    So, in any way, PHP is such thing which just works.

    Congrats! :)

    --
    user@ubuntubox:~$ stfu This server is going down for shutdown NOW!
    1. Re:One of pillars of success: manual by Just+Some+Guy · · Score: 2, Insightful
      PHP manual from the very begining was perfect

      I think you got the causality backwards. If PHP's manual wasn't top-notch, then noone would ever be able to figure out the 15 variations on each function (each with arbitrarily different argument ordering). People didn't flock to the PHP manual because PHP is such a great language.

      In other words, PHP leans on a strong document set just to make it usable. That's quite different than most other languages commonly in use.

      --
      Dewey, what part of this looks like authorities should be involved?
  11. PHP 1.0 - 2.0 - 3.0 ... by J-F+Mammet · · Score: 2, Insightful

    PHP/FI 1.0 wasn't really a scripting language, it was more like a big perl (or was it C?) script that would put some variables in a html page. Not really that useful but a nice idea.
    I discovered and started using PHP by the time the first beta of PHP 2.0 had been released. What a pleasure this was to convert my old clunky C CGI scripts to PHP. No more compiling, no more mallocs. Weee :)
    7 years (I think, maybe it's 6) later I'm still using PHP for everything at work, and I certainly don't plan to use anything else (not that I could if I wanted, rewriting everything would take a few years...).
    Congrats to the PHP Team, and thanks !

  12. Slow to catch... by ral315 · · Score: 2, Funny

    Apparently, it was so slow to catch that it was posted a day late!

    Or is this a dupe from yesterday?

  13. PHP definitely does not follow the KISS principle by Peter+Cooper · · Score: 5, Informative

    PHP has long followed the KISS principle

    Are you smoking crack? PHP is more inconsistent than any other language I've encountered. I'm not disrespecting the team, as I'm sure they've worked hard, and it's great to celebrate ten years of an admittedly very useful language, but PHP is not an inherently easy language.. it's just one that lets you code sloppily and get away with it.

    For a start, PHP functions seem to have no consistency at all. Sometimes you get verb/object, sometimes object/verb. Sometimes you get underscores, sometimes you don't. Consider.. is_object but isset. str_rot13 but strpos. php_uname but phpversion. There are hundreds of these. It's the reason I could never learn PHP, it's like learning Chinese, but I found Perl (and now Ruby) easy due to their relative consistency. Sometimes PHP uses "to", sometimes it uses "2".. huh what's that about?

    Unlike Perl which has a few regular expression constructions and a handful of modifiers.. PHP has a whole glut of regular expression functions which have confusing names, some of which take certain modifiers, and some that don't. As someone who has mastered Perl's regular expressions I find it a major struggle when I have to tackle something in PHP (I admit, I've never 'learned' PHP, but I find it a very hard language to make quick fixes on for other people.. compared to, say, C, VB or Python, languages I don't know intimately but can easily hack).

    PHP has thousands of core functions.. nuts! And why does PHP have such a bizarre lack of abstraction? PHP often has about 10 functions compared to other languages' single function.. with each of the 10 doing a slightly different thing. When it comes to being overly wordy and inconsistent, I doubt anything can beat PHP, but, well, I'd like to see someone bring up a language that is!

    So if you were going to call any language "KISS", it'd be Ruby or Python.. but PHP? No way.

  14. Success of PHP easy to understand by iJed · · Score: 5, Insightful

    I think it is obvious why PHP has become so popular:

    1. It is very easy to learn

    2. It is easy to use (unlike ASP.NET) and relatively simple

    3. The syntax is derived from C and perl

    4. It is free

    1. Re:Success of PHP easy to understand by moof1138 · · Score: 2, Insightful

      Two other big reasons are

      5. It's fast.

      6. It is easy for hosting providers to deploy. There are tons of hosting companies out there give customers PHP support because it is easier to support on a box running a bunch of vhosts. Other web scripting environmants either have security issues (mod_perl is really scary if you don't trust other people running on the same host), have limitations for what directories scripts are run from, or are just a PITA to deploy in a simple yet relatively secure way. (That's not to say that PHP apps themselves are secure, but that you can set things up so that when you 0wn the PHP app you don't get much else.)

      --

      Hyperbole is the worst thing ever.
    2. Re:Success of PHP easy to understand by jpkunst · · Score: 2, Insightful

      If you use either if (is_null($test)) or if ($test === null) instead of if ($test == null) you get the expected results.

      JP

    3. Re:Success of PHP easy to understand by H0p313ss · · Score: 2, Insightful

      #6 is a BIG one, it's the only reason I'm playing with PHP rather than JSP or servelets.

      --
      XML is a known as a key material required to create SMD: Software of Mass Destruction
  15. Looking forward by joebp · · Score: 3, Insightful

    Let's hope that in the future the PHP developers can come up with some ways to make the code produced by PHP developers more secure.

    One of the huge problems with PHP is the massive number of XSS and SQL injection vulns present in code. Partially because PHP is used by beginners, but mainly because PHP does not help the developer write secure code. It's fast and easy to write, but allows you to shoot yourself in the foot. Just like C. See this paper on precise tainting for an example solution to the problems. It would break compatibility with most software written in PHP, but that's not neccessarily a bad thing when most of it is insecure trash.

    1. Re:Looking forward by kuzb · · Score: 2, Informative
      meh, you guys always do it wrong. Here is the *right* way:
      <?php

      /* Use this to normalize incoming data. Don't rely on server settings! Always test! */
      function fixSlash($in)
      {
      return get_magic_quotes_gpc() ? stripslashes($in) : $in;
      }

      /* if you're expecting an int, best to cast it. same idea for floats. another method is to use ctype_number() to test to see if something is all digits. DO NOT use is_numeric() or is_int() as is_numeric tests for many different numeric representations and is_int() only works on real integers, not the strings that come back from a GET or POST */
      $fromUser = (int)$_GET['someNumber'];

      /* if you're expecting text, normalize it */
      $fromUser = fixSlash($_GET['someEvilValue']);

      /* now, use the escaping functions SPECIFIC to the database server used. In this case, we'll use MySQL */
      $fromUser = mysql_escape_string($fromUser);

      /* lastly, make the query. Standard SQL doesn't quote numbers; if this is a number, and not a string, remove the quotes */
      $query = sprintf("SELECT * FROM foo WHERE bar='%s'", $fromUser);

      ?>
      Also notice how we use the superglobals for everything (superglobals are $_GET, $_POST, $_COOKIE, $_SERVER, etc..) these will always work, regardless of the register_globals setting.

      If you code in this manner, it doesn't matter what magic_quotes_gpc is set to, at all, ever. This method is primarily procedural, but if you have an OOP structure in place, it's a good idea to build a filter object. This object can then be called from setters to perform these tasks for you which can make it all very transparent once set up.

      If you always code in a portable manner, you'll have fewer surprises later on.

      --
      BeauHD. Worst editor since kdawson.
  16. Re:PHP definitely does not follow the KISS princip by Peter+Cooper · · Score: 2, Insightful

    Aha, I was looking for a worse language than PHP and I think we've found it. ColdFusion! How could I forget about that nugget of programming fools' gold ;-)

    I would agree that PHP makes a decent web scripting language for basic tasks (polls, counter, guest book, a bit of remote inclusion), but I am horrified to see people actually using it for serious stuff like enterprise level systems. That sort of stuff makes the blood freeze. I feel really sorry for the corporations who get sucked into it.

  17. Database independence by 3770 · · Score: 2, Insightful

    I support the idea of database independence.

    But it should be done by using standard SQL.

    Unfortunately, that is not a losing battle, it is a lost battle.

    The database vendors doesn't care about standard SQL.

    --
    The Internet is full. Go Away!!!
    1. Re:Database independence by stephenbooth · · Score: 2, Insightful

      Some do, some don't. It's now possible to write 100% ANSI compliant systems in Oracle and MS-SQL amongst others (those are the two I know of for sure, I also know there are others). Obviously you can choose to use non-ANSI compliant code if you so wish. Sometimes there are good reasons to do so, using supplied packages to perform tasks that would otherwise have to be coded is one. As noted earlier, writing your code to fit a particular RDBMS will often result in faster code. It may also give you a faster time to market (don't have to reinvent existing code).

      Stephen

      --
      "Don't write down to your readers, the only people less intelligent than you can't read" - Sign on Newspaper Office Wall
    2. Re:Database independence by 3770 · · Score: 2, Informative
      --
      The Internet is full. Go Away!!!
    3. Re:Database independence by stephenbooth · · Score: 2, Informative

      Looks interesting. It doesn't appear to be 100% accurate though. There are a number of features (e.g. E051-08, E021-06 and E021-04) that it says that Oracle 9 does not have but I know it does, or at least it has something matching the description given (maybe I'm misunderstanding something).

      Stephen

      --
      "Don't write down to your readers, the only people less intelligent than you can't read" - Sign on Newspaper Office Wall
    4. Re:Database independence by 3770 · · Score: 2, Informative

      I think that the chart is rather accurate. I know the people that made it and one of them is in the SQL Standards committee (Åke Persson).

      It may be really picky and unforgiving, however, and even a minor deviation from the standard might disqualify a feature from being listed as supported for a certain database. I can't say that that isn't the case. All I'm saying is that they guys that made the list know what they are talking about.

      Åke Persson is also a compiler expert and he wrote this tool:

      http://developer.mimer.com/validator/index.htm

      You can use it to validate your SQL to SQL-92, -99 and 2003. Pretty nifty if I may say so.

      --
      The Internet is full. Go Away!!!
  18. Re:PHP definitely does not follow the KISS princip by lawpoop · · Score: 2, Insightful

    I agree with the simple inconsistencies. What annoyts -- no, frustrates -- me most is that the functions that have a string and an array for an argument is that sometimes the array comes first, and sometimes the other argument comes first. I hate it.

    --
    Computers are useless. They can only give you answers.
    -- Pablo Picasso
  19. PHP: Hypertext Preprocessor by 55555+Manbabies! · · Score: 2, Funny

    Here's to you, PHP, five golden manbabies of the goldest sort.

  20. I get it, but I don't want it by Uzziel · · Score: 3, Insightful

    PHP is an abomination.
    It was very clever and very handy when it was first developed, but there are many much better systems for building web pages available today.

    Its object-oriented features are kludgy, its syntax is a throwback to C, and it in a realm where string handling is ubiquitous, it provides you with such great functions as strtok() and strncmp(). I mean come on, haven't we evolved just a bit past using the C standard library for string handling in our freaking web applications?

    Personal Home Pages is fine for whipping up a quick data-driven website, but if you want to build a large application it's crap.

    1. Re:I get it, but I don't want it by aweiland · · Score: 2, Insightful

      PHP 5 OO features are far from kludgy (it's modelled after Java). Perl's so called OO is 10x more a kludge.

      What's wrong with the C string functions? They're fast, useful, and a lot of programmers know them. You're not limited to them. You can use split() or explode() to do what strtok does but get an array. Plus they are a hell of a lot better for dealing with strings than all of Java.

      And last I checked PHP stands for: PHP Hypertext Preprocessor.

  21. So what... by The+Woodworker · · Score: 2, Funny

    I was born clairvoyant and was writing PHP code in womb. BTW, if anyone wants I can give you a heads up on Linux 6.6.6 and Windows WTF. Those come out AFTER the apocolypse.

    --
    Give a man a fish and he'll eat for a day. Teach him to fish and he'll wipe out the species.
  22. Re:PHP definitely does not follow the KISS princip by bobdinkel · · Score: 4, Informative
    As someone who has mastered Perl's regular expressions I find it a major struggle when I have to tackle something in PHP (I admit, I've never 'learned' PHP, but I find it a very hard language to make quick fixes on for other people.. compared to, say, C, VB or Python, languages I don't know intimately but can easily hack).

    Just a quick point--you can use Perl's regular expressions in PHP. And that's usually what I see people doing. As a matter of fact, it is recommended in the PHP documentation that Perl's regular expressions be used: Note: preg_match(), which uses a Perl-compatible regular expression syntax, is often a faster alternative to ereg().

    --
    A publicly traded company exists solely to make profits for shareholders.
  23. Re:PHP definitely does not follow the KISS princip by killjoe · · Score: 3, Insightful

    Lucky for you there is a centralized, annotated, comprehensive, searchable, accessable by web services manual and a centralized repository of standard classes.

    People underestimate the power of those two things. CPAN is the number one reason why PERL is still so popular.

    --
    evil is as evil does
  24. PHP for teaching by lbya · · Score: 2, Interesting


    So here it is 2005, and I need to teach the "interactive" part of the graphic design curriculum to college- and graduate-level art students. Is PHP appropriate for this today?

    In a semester, I'd like my students to learn some fundamentals of programming. Like, what a variable is.

    I find that when "interactive" classes are taught in environments like Flash or Director, design students wind up cobbling together bits and pieces of things without really knowing how the pieces work, and then they get frustrated when the whole thing doesn't work. Plus the environment itself becomes confusing (there is really no logic to Flash). Therefore I'm thinking I'd like to go "back to basics" for a semester. Just as design students know a lot about how printing works, they should know how code works.

    The Processing environment was designed for teaching-- a kind of simplified Java. But while its graphics support is sort of strong, it doesn't have great network connectivity, with the result that things you make in Processing tend to feel a bit self-contained, like science experiments.

    Going the opposite way, what do people think about PHP as a teaching language? It has syntactic similarity to C or Java, for learning "if then" and whatnot, in a way which could be applicable to other languages later on; has a lot of functionality in the core language; and maybe unparalleled online documentation. There is no development environment to learn other than a text editor and SFTP. And even though the idea of your code running exclusively on a server might be confusing, I think there could also be value for design students to learn the difference between server and client since it's a fundamental relationship in a lot of graphic design problems.

    Remember also that these are design students not comp sci students, which partially determines the kinds of programming issues these students need to be versed in.

    Thoughts from about PHP as a teaching language for non-programmers?

  25. Re:mysql_escape_string by joebp · · Score: 4, Interesting

    mysql_escape_string is deprecated and should never be used in production code! The replacement is the hilariously named mysql_real_escape_string.

    Your "not that hard" comment is rather amusing with this in mind.

  26. Re:Enterprise level systems by Peter+Cooper · · Score: 2, Insightful

    The fact you are using a Computer Science degree to back up your argument is telling. A Software Engineering would be useful, maybe, but a CS degree does not demonstrate you learned to develop enterprise level applications as this is not a focus of CS, as has been discussed many times in the "Shall I get a CS degree?" Ask Slashdot threads.

    I'm sure you are developing fine enterprise level PHP apps, but I can also crack open a Mac Mini with a fish slice. It doesn't demonstrate it's one of the best tools for the job, even if it does work. (This is why most low-level systems software is written in C, despite there being plenty of arguments that there's "nothing wrong" in using others.)

    And, yes, you're right, it's elitism. I'm elitist to the point where I feel that using any sub-par tool that's not suited to the task is not a wise long-term strategy. But, well, thanks for expressing that in some situations it seems to work.

  27. Not so good an idea by soloport · · Score: 3, Insightful

    Database abstraction is a frustration of mine.

    Say, for example a "real" DBA writes a shopping cart schema / application, using a "genuine" (ACID-compliant) DB, the scalability will be phenomenal; The speed will be incredible because much of the code will be handed TO the database -- not parsed and parsed and parsed away at the PHP/Java/whatever-script level.

    Now, let's say a "wannabe" DBA writes a shopping cart schema / application using MySQL. Then to "help" the Postgres folks out, the DBA adds an abstration layer. Woo hoo!!! Useless... Essentially, I'm offered a way to drive a Ferari (Postgres) down the sidewalk, negotiating with pedestrians all day, as if I were traveling by skateboard (MySQL).

    Unfortunately, the number of examples of the later are a dime a dozen. The number of examples of the former are near zero. Think about why you'd even WANT abstraction. In most real-world cases it's rather useless and undesireable.

  28. Re:PHP definitely does not follow the KISS princip by bigman2003 · · Score: 2, Informative

    Well, your anecdote of 2 ColdFusion sites that crashed doesn't really prove much.

    I've been working with ColdFusion for about 5 years now. My sites don't crash- and I get 10-20 million hits per month. Not huge, but a pretty good number. (No...this is not the site that is in my sig...)

    I *might* get 2 or 3 'unhandled exceptions' in a day. And those are always caused by search engines that are hitting templates with bad queries. It is interesting to see the queries they send, "hmm...why did they decide to make the usernumber 99A4 this time instead of 994" the error is caused because *I* foolishly forgot to put a val() function around the number in a query. So I fix it, and move on.

    If the person running the server has half of a brain, their sites won't crash. I've used ColdFusion from version 3, on up to 7. And they always put in great new features and capabilities that other web programmers need to work hours to duplicate- but for ColdFusion it is a built-in function.

    Yes, people have been making fun of it for years- and it reached a peak when FuckedCompany was complaining about it a lot. But there are so many good things about it a lot of people turn a blind eye to. Hell, the Verity engine itself is worth the entire package price. I can set up a searchable index of PDF, Word, Text, files in about 30 minutes. This is stuff that people want, and really appreciate.

    --
    No reason to lie.
  29. Career by daeg · · Score: 2, Insightful

    I, too, have PHP to thank for a wonderful career. While I know that PHP is not the best language for the massive applications I've done, PHP developers are relatively easy to find and train. That is a major marketing factor for companies. Rails is great but how many (available!) workers are there? Very few. Same with Python. PHP can be very powerful when done right. The last major system I wrote with it included a call center (using the wonderful company Voxeo for hosting) that dropped right into the CRM and loan processing software. The current system includes a self-running tiered hosting system (Bind 9, Apache 2, PHP 5.1-dev, PGSQL 8); the daemons (written in PHP) detect server load and move sites accordingly to other slaves.

  30. Why I Like PHP by ajs318 · · Score: 3, Informative

    I like PHP because it's basically a bastardised dialect of Perl, and I like Perl.

    I like Perl because it uses different operators for string concatenation and addition. That doesn't sound like much of a reason, but a lot of the programming I'm doing seems to call for either adding numbers or concatenating strings.

    Now, in some languages, strings and numbers are completely different types. Then it's sort-of OK to recycle an operator to mean something completely different, because the computer knows what you mean. But there are several dynamically-typed languages which use + to concatenate strings. Then the magic guesser gets its knickers in a twist with not being able to work out whether something is really a number or just a string that looks like a number. This causes problems when you try to add numbers and find yourself concatenating strings. I wasted the best part of a day on a stupid bit of JavaScript for a DHTML application with increment/decrement buttons.

    In Perl {and in PHP}, 3 + 4 gives 7. "3" + 4 gives 7. 3 + "4" gives 7. And "3" + "4" gives 7. If you actually want to concatenate the 4 onto the end of the 3, you have to use the concatenation operator . instead of the addition operator +. 3 . 4 gives "34". "3" . 4 gives "34". 3 . "4" gives 34. And "3" . "4" gives "34". That is simple.

    Perl is a bit of a 'mare for n00bs because everything is a shorthand representation. There is the wonderful $_ which avoids cluttering up your script with temporary variables. You don't need brackets round function arguments {like the British BASIC dialects of the '80s}. Everything is optimised for the hardcore hacker, not the beginner. It only looks pretty when you realise that simplicity is beauty.

    PHP has a more consistent interface than Perl. So you can't just drop in a regular expression, you have to call a function with the regular expression inside a string. It also does more stuff automagically for you, like keeping hashes ordered {Perl doesn't bother, expecting you to keep a separate array if you really care} and dereferencing everything {Perl expects you to manually create and dereference references when you make multidimensional arrays}. So it's probably a bit slower running, but it's quicker to get an app up and running.

    --
    Je fume. Tu fumes. Nous fûmes!
  31. It's how you use it... by sherriw · · Score: 5, Insightful

    I've been developing website backends in PHP for 3 years, and large enterprise-scale apps for the past 1 year. It's a common misconception that PHP isn't appropriate for large applications.

    It's all in how you use it. Do you hack together a bunch of pages with isolated scripts talking to html forms and databases in an ad-hoc manner? Or did you start with a solid application design model from the start and follow through with time-tested methodologies?

    PHP gets a bad rep because of the large number of inexperienced developers using it with poor results. I've developed full CRM and ERP apps with it including invoicing and ticketing systems that scale beautifully and are a dream to maintain. PHP is fast, free, and easy to use.

    It's the responsibility of the developers to use more mature practices when developing large apps- and to recognize the fact that small site admin areas often evolve into larger apps. Plan and design!

  32. We brought the cake by mgkimsal2 · · Score: 3, Funny

    http://phpweblogs.com/phpcake.jpg

    Yeah, we're a bit over the top for PHP. The whole company had cake and ice cream to celebrate. :)

  33. Easy php installation by PsiPsiStar · · Score: 2, Informative

    If anyone needs an easy installation of PHP on a windows platform, try EasyPHP. The site is all in french, but it's free and good. It automatically installs and integrates PHP, MySQL and an Apache server.

    Personally, I've set up a lot of moodle sites (www.moodle.org) which is the best free LMS I've found.

    Check it out if anyone is into e-learning or web based training.

    (Make sure you have a fast server if you want to put a lot of students on it. The quiz modules are very useful, but they use an ungodly amout of resources if you're teaching a class of +30 students.)

    --

    ___
    It's the end of my comment as I know it and I feel fine.
  34. There's also ADOdb by Mitchell+Mebane · · Score: 3, Informative

    ADOdb Site

    I've never used PEAR, so I can't compare the two, but ADOdb is quite nice from my experience.

    --

    The roots of education are bitter, but the fruit is sweet.
    --Aristotle
  35. Still broken. by Pingster · · Score: 3, Interesting

    Ten years and the == operator is still completely broken. Any hope of fixing it in the next ten?
    % cat test.php
    <?php if ("spam" == 0) print "I am insane."; ?>

    % php test.php
    I am insane.

    %

    Suppose A equals B, and also B equals C. Any reasonable person would expect that A equals C, right? Oh yeah?

    % cat equality.php
    <?php

    $a = 0;
    $b = "eggs";
    $c = "spam";

    print ($a == $b) ? "a == b\n" : "a != b\n";
    print ($b == $c) ? "b == c\n" : "b != c\n";
    print ($a == $c) ? "a == c\n" : "a != c\n";
    print ($a == $d) ? "a == d\n" : "a != d\n";
    print ($b == $d) ? "b == d\n" : "b != d\n";
    print ($c == $d) ? "c == d\n" : "c != d\n";

    ?>

    % php equality.php
    a == b
    b != c
    a == c
    a == d
    b != d
    c != d

    %
    Try explaining that to a first-time programmer.
  36. Re:PHP definitely does not follow the KISS princip by julesh · · Score: 3, Insightful

    For a start, PHP functions seem to have no consistency at all. Sometimes you get verb/object, sometimes object/verb. Sometimes you get underscores, sometimes you don't. Consider.. is_object but isset. str_rot13 but strpos. php_uname but phpversion. There are hundreds of these. It's the reason I could never learn PHP, it's like learning Chinese, but I found Perl (and now Ruby) easy due to their relative consistency. Sometimes PHP uses "to", sometimes it uses "2".. huh what's that about?

    Most of the functions in the PHP distribution are named after a function that does the same thing in the C library that PHP uses to implement the feature. PHP is designed so that if you're familiar with the C library that it is using, you can very easily get the hang of the PHP version.

    This doesn't excuse some of the weirdnesses in the core library, though -- str_rot13 (and the other string functions with underscores in them) is clearly wrong, as the earliest string functions followed the standard C library naming conventions.

    To address your other examples: isset() is an operator that looks syntactically like a function, and would have been named in this fashion to mirror the other such operators (sizeof(), unset()). is_object() et al are functions that were implemented independently of this, and at the time there was no conflict. I see no excuse for the php_uname/phpversion difference.

    PHP has thousands of core functions.. nuts! And why does PHP have such a bizarre lack of abstraction? PHP often has about 10 functions compared to other languages' single function.. with each of the 10 doing a slightly different thing. When it comes to being overly wordy and inconsistent, I doubt anything can beat PHP, but, well, I'd like to see someone bring up a language that is!

    I don't like to nitpick, but... those aren't all core functions. They're just functions that are distributed with the core, kind of like the applications that come with a Linux distribution. You can build a stripped down PHP without them, if you want.

  37. Re:PHP definitely does not follow the KISS princip by jez9999 · · Score: 2, Informative

    2. session-handling

    CGI::Session.

  38. Wrong, wrong, wrong by weston · · Score: 2, Insightful

    "you can use Perl's regular expressions in PHP."

    Nope. You can't. Well, you can. Well, sortof. Sometimes. With some syntactical exceptions, and lots of thinking about escape sequences, and passing parameters a different way. And that's the gotcha. You start thinking it's going to be the same -- and it's not.