Slashdot Mirror
The New PHP
An anonymous reader writes "This article at O'Reilly Programming suggests that PHP, a language known as much for its weaknesses as its strengths, has made steady progress over the past few years in fixing its problems. From the article: 'A few years ago, PHP had several large frameworks (e.g. CakePHP, CodeIgniter, and so on). Each framework was an island and provided its own implementation of features commonly found in other frameworks. Unfortunately, these insular implementations were likely not compatible with each other and forced developers to lock themselves in with a specific framework for a given project. Today the story is different. The new PHP community uses package management and component libraries to mix and match the best available tools. ... There are also exciting things happening with PHP under the hood, too. The PHP Zend Engine recently introduced memory usage optimizations. The memory usage in PHP 5.5 is far less than earlier versions.'"
Wake me up when they implement namespaces correctly. With a syntax that doesn't look like Satan's diverticulitis.
It is nice to see that PHP is starting to grow up a little bit. They have long way to go.
Have they managed to keep from breaking crypt() recently?
#DeleteChrome
Python and Ruby both benefit greatly from caching mechanisms (as does any other language) and garbage collection has never been something added after the fact in PHP.
It runs like balls on the Raspberry Pi, but that's the Pi's fault.
Spent All My Mod Points
If they haven't fixed the horrific inconsistent commands and behaviours with said commands, then every NOPE that my body can muster.
Silently converting things in such awful ways led to a month of headaches with that bullshit.
Never again.
I should never need to use a library to be able to actually get anywhere. A library should make it easier, but it should never have to fix problems with a language.
Even JavaScript isn't as bad as that, there are only a few minor areas where implementation-specific issues pop up, like the awful CSS rule stuff, input codes, and some other stuff, with PHP, it is EVERYWHERE.
Same as the Old PHP.
Let me know when they stop calling bugs features because they are documented.
https://bugs.php.net/bug.php?id=39579
I've been complaining to a friend of mine about PHP. I was an early adopter around 1.0/2.0, avid user at 3, and have fallen out with it since then. PHP was good, even revolutionary at the time because you either had C or perl PHP had a friendliness to it... Something that ended up making it second rate.
It's always been second rate. Even the PHP devs themselves end up coding vulnerabilities. And look at MtGox. What was it coded in? PHP!
Why in 2014, do I have to decorate variables with '$'? Why is the assiciative array syntax take two characters that look a comparison operator? Why do I need == and ===? ANd vaiable confusion between $_GET, $_POST and $_COOKIE
No one can do a safe site in PHP, it's just too much work to 1) know best practices and 2) code it.
Finally the web has changed. Back when it enabled a dynamic site, it was the shit. In a web 2.0 world it is shit. You've got to work with MIME, HTML, PHP CSS, JSON, JavaScript.... There is no "php" solution.
Today, there are many ways to develop dynamic web content. My favorite two are Node[JS] and witty (webtoolkit.eu). While there is no "ace of the page" the Witty apprror say SPDY2.0, approach is best, where you write your application code and it renders code for whatever browser and browser capabilities it has. If Websockets, HTML6, or SPDY2.0 comes out, you just recompile your app against the new library that just uses the new features as appropriate.
In retrospect, there never really was a time when PHP was a "good thing".
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
Being long in the tooth I do all my web development via Perl using my own nice call back templating engine and of course CGI.pm. Nice separation of code and html -neither of the two find themselves in the same file. Once in a while I have to do some repair work for customers in PHP and in horror find the html and code mixed to together with wild abandon and massive uses of global variable and I wonder PHP is so darn popular.
Until I can get at least a warning on reads to undefined variables I will never use PHP for anything serious again.
Why in 2014, do I have to decorate variables with '$'?
That is your first complaint about PHP? That? I can't stand PHP but, seriously, that is first on your list of PHP badness?
I live ze unknown. I love ze unknown. I am ze unknown.
Many of the problems with PHP are from the crappy language implementation. I recently came across a Java implementation of the language. It's been around forever, but as I hadn't heard of it, I figure many people reading this thread haven't either. It's Quercus. It's certainly worth a look as a Zend alternative.
Be relentless!
Especially since it's actually one of the only things that makes PHP (barely) readable.
Someone had to do it.
I'm sometimes amused by many of the negative emotional reactions to PHP. The best I can guess, having languages around that any joe can pick up reduces some geek's feelings of superiority ('leetness'). Knowing several languages, I can't say that any one of them is perfect, otherwise we wouldn't have so many.
I've never done my own garbage collection, and PHP just updated it in 5.3.
PHP works, it's fast as heck, and I can do anything you can do in python/perl just as well and way faster. My host for my hobby site (Shameless Plug) gives me php and a mysql DB for $7 bucks a month, and that's probably more than I should be paying. If I want perl/python that goes up to $100/mo...
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I'm still waiting for PHP to be completely case sensitive, a sane scoping scheme and real object oriented (can you say polymorphism)
Another day closer to redwood heaven
The beautiful thing is their lovely page explaining that it wasn't an insecure design, just one which "could be misused".
I'd say that a feature that easy to "misuse" in ways that lead to security holes is, in fact, a pretty good example of an "insecure design".
My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
If you can't tell the difference between GET, POST and COOKIE you have bigger problems.
You complain about that but you suggest Node? Node is fine, but pulling out request variables requires you to parse through the headers and query string.
Further more, sanitizing DB inputs and making sure your logic doesn't suck isn't the worst thing you have to do. Mt.Gox went down because their API was stupid, not because of some fundamental flaw in PHP.
I don't know. php is the Gary busey of programming languages. Used to be kind of crazy. Still slightly temperamental, but getting better.
Personally, I just don't think there are bad languages to develop for. C# is nice, if you don't mind being strapped to IIS or Mono, Python and Ruby are clean and sane, PHP is wacky but gets the job done. Perl is old but dependable and still quite spry. I just don't get the language hate.
Non impediti ratione cogitationus.
I don't normally like linking to blog posts, but this one pretty much sums up PHP for me:
http://me.veekun.com/blog/2012/04/09/php-a-fractal-of-bad-design/
His analogy is very apt.
The very fact that several websites exist to document inconsistencies in the language implementation should make you wary.
Where do you find compiler devs who manage to evaluate 0x0+2 to 4?
The fact that there is a function called real_escape_string scares the shit out my me, because it implies there exists a function called escape_string which doesn't really escape strings.
You can get a dedicated VPS from any number of companies for ~$20 a month and run QBASIC on it for all they care.
Sounds like your shameless plug hosting provider doesn't deserve any plugging. Get a VPS http://lowendbox.com/ and pay even less than 7 bucks/month. Hell, I had hosting for a buck a month which included Perl and Python until the owner passed away.
Let me know when they fix at least half of the issues listed in this article .
You might want to check out Dancer (or Dancer2) or any other modern Perl framework to make life a little easier.
"Magic mix-and-match e-Lego's" == Marketing Buzzshit
Table-ized A.I.
Why in 2014, do I have to decorate variables with '$'?
Well for one thing effortless string interpolation... and it nicely identifies what is a scalar
That reminds me of people who call a document "x_final", but then change their mind and so create a second one called "x_final_final", and change their mind again to get "x_really_final_this_time_I_promise". I suggest version numbers, but then they say, "But version numbers don't tell me which one is final". I gave up on them.
Table-ized A.I.
Every common language out there has ugly stuff of one kind or another.
Table-ized A.I.
I used to think there weren't plain bad languages. Now with more experience under my belt, I know better.
Every language has quirks. You get used to them, and do what you need to do. PHP is almost nothing but quirks. The only languages I can think of worse than PHP are those deliberately designed to be bad: Brainfuck, Malbolge, INTERCAL, and the like. I'm not even sure that some of those are worse than PHP.
The entire structure and implementation of PHP screams of hasty decisions by cowboy coders who just decided to write an interpreter one day without sitting down and actually designing anything. Reading almost anything about the language is an exercise in counting and cataloguing "WTF" moments of various magnitudes. There have been many "new PHP" modifications, addressing various numbers of warts in the language. However, there are so many misfeatures and design flaws in PHP that such a process would be effectively unending even if the alterations weren't themselves riddled with defects.
A cheap VPS with full Perl/Python support costs less than $7 per month, and you can run PHP on it if you really want.
https://cloud.atlantic.net/index.php?page=signup_ws .. (there's LOOOOTS more) ... or just use Google AppEngine if you really want Python....
https://www.digitalocean.com/
Make PHP the lauging stock of many a programmer.
The language's development has been in the wrong hands from day one.
You can do great things in Python because of Python.
You can do great things in PHP in spite of PHP.
In an object oriented language, as PHP attempts to be, $ is a stupid idea, just like decorating variables with types, like bInstalled (bool installed) it iMaxLength. It's not such a bad idea in JavaScript though, where anything goes.
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
Why? Because it pays my rent!
... I'd rather poke my eyes out with PHP than even think about putting Java on my server.
You might not be aware of PHP in the old days, but they used to move all the variables into the script so that
$_GET['x'] and $_POST['y']
would be $x and $y... ("register globals") So yeah, you couldn't tell where they came from. The situation with $_* greatly improved things especially when they deprecated register globals.
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
There never really was a time when any single programming tool or paradigm was a "good thing".
You also have best practices on Desktop programs. There is nothing that stops desktop devs to concat SQL query from textbox.(get)Text and suffers from SQL Injection, like I did when I was in high school, and like the many production code I have fixed since then.
Windows, Java, Flash, and PDF Readers are not coded in PHP, yet they are also buried neck deep in security patches. Unix/Linux neither, and it's thanks to them how "rootkit" got its name.
You never should have to sanitize your db inputs. Why? Because then you have to always unsantize them, else you end up with a crap string because it isn't escaped/unescaped enough times. The right thing to do is to use the database driver's bind interface. Basically, your DB values should be treated as opaque blobs as far as entry and retrieval go. Now if you need to verify a date, that's another matter. But you should be treating them as opaque blobs, full of nulls, quotes, semicolons and unprintable characters.
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
I do a lot of coding in PHP, and there's a lot of things I don't like about it, but your particular dislikes don't make a lot of sense.
Why in 2014, do I have to decorate variables with '$'?
It's not like PHP was written in 1965 and thus there was some hardware (memory footprint, compilation speed, etc) reason variables are prefixed with a dollar sign. It was a design choice. That's so you can do this:
$count=5;
echo "The total is $count.";
And you can use the same variable syntax in your code as in strings that are automatically parsed.
Why is the assiciative array syntax take two characters that look a comparison operator?
It doesn't "look" like a comparison operator if you actually know what the operators are. <= and >= are comparison operators, and => is not a comparison operator in any language I've ever used. A single equal sign looks like a comparison operator too, and woe to the developer that doesn't have the universal C-like basic operators (used in dozens of modern languages) memorized backwards and forwards.
Why do I need == and ===?
For the same reason that Javascript and other scripting languages need it. Those languages do automatic type conversion, and sometimes you don't want that to occur. The alternative is manually casting things, which isn't very script-like at all, and having to explicitly deal with types is more like C than an "easy to use" scripting language. Thus there are two equality operators for the times you don't really want 0 to equal null to equal false.
This one is even more ironic considering Javascript based node.js is your favorite server side platform, and thus you would also have to use both == and === operators in your preferred language anyway.
ANd vaiable confusion between $_GET, $_POST and $_COOKIE
I don't even know where to begin on this one. They are 3 entirely different things, with the most self-explanatory names I can think of. That's exactly as it should be. Look at $_REQUEST if it's too difficult to figure out which you should be using (and woe to your client if that's the case).
Better known as 318230.
I was about to make a joke, but seriously, the only language I can think of that doesn't have some nasty gotcha is . . . . ugh . . . BASIC. Python has the whole whitespace deal, Perl code tends to be unkempt, Java is fuggin java, Ada is a secret government spy, I don't even want to talk about C++, Bash is fine as long as you never have the misfortune of using quotes or variables, C guarantees regular segfaults, Matlab/Octave will delightfully inform you of your bugs deep in system library code, SAS's userfriendliness pars that of installing Linux from scratch, you can't write more than four lines of Fortran without painting some Star Trek action figure, and just fuck Cobol.
:p
Honestly, BASIC's wins this round just by virtue of being so limited that it's hard to shoot yourself in the foot. I don't count GOTO, as jumps aren't really language specific. Having tutored programming for years, I can say that students are perfectly able to write speghetti code with or without goto.
I read TFA and all I got was this lousy cookie
Take a bad programmer and they can turn anything into a mess. Don't blame it on the language.
It's that same easy substitution, i.e. $sql = "SELECT fname, lname from people where id='$id'" that leads to data breaches.
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
I have build some very large PHP based web systems(over the last 10 years) and recently dipped my toes into the Python pond. My python skills might be a tiny fraction of my PHP or C++ skills and I doubt that I am using Python anywhere near its potential, yet my productivity is already much higher and getting faster. I am waiting for there to be a catch but so far I haven't found one.
It is shaping up to be one of these things where my only regret is not switching sooner.
I was a huge defender of PHP for a long time but that time is over. There are interesting things like HHVM that are another bandaid for PHP but I am sick of making PHP work. I am sick of typing all those stupid dollar signs. I'll just say what so many have said before, "Python is like typing pseudo code, except you are actually coding." I don't look at my python and shudder.
PHP reminds me of some of my own projects where I changed course many times leaving strange little architectures and changes in philosophy. The longer the project goes on and the more it changes direction the more debris it leaves behind. It is not necessarily broken just sort of all just off.
Where Python is a tiny problem with the web is that setting up a development environment took me a tiny bit more work than the usual LAMP setup. This might make it harder for beginners but maybe that is a good thing. I don't mind leaving the beginners back in PHP land.
yeah, you Phail it...
Here we go again!
Like making it more difficult syntactically prevents SQL injection attacks either:
var sql="SELECT fname, lname from people where id='"+id+"'";
Same vulnerability in Javascript.
Better known as 318230.
you can't write more than four lines of Fortran without painting some Star Trek action figure
I like that. I'm going to use that.
And GOTO is over-villified. In BASIC it is the only sane way to do error handling. In other languages, I frequently use the "continue" operation, which is just a limited goto with a different name.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
We use PHP and have recently moved to the Laravel framework and PHP5.5. Small things like [] for array is great. Fast, and Laravel 4 means MVC. And , off topic, but apache (2.4) configuration is pants and makes no sense!
I don't hate PHP, but I hate Frameworks.
As PHP evolved, features kept being depreciated and with 5.5, they will finally break Wordpress. Wordpress started causing problems at 5.3 because of changes to OOP sanity checks.
But seriously, please wean yourself off the OOP teat, Perl was not designed as OOP, and OOP rendered it completely useless as a web language. PHP wasn't OOP, but kept gaining OOP features, and again it's being rendered useless as a web language. Javascript's the only thing that has resisted becoming an unmanageable OOP hellhole.
Package management systems in Perl rendered upgrading any one thing a hazardous house of cards, and we're just content if upgrading Perl itself doesn't catch the server on fire. PHP hasn't adopted this insanity, and I hope it stays this way.
Python will send your future children to college.
You mean like PDO?
By sanitize, I mean, don't just write, "INSERT INTO table (col1, col2, col3, col4) VALUES ($unescapedValue, $hosed, $haxedLol, $bobbyTables)".
Which you can totally do in Ruby, Python, C#, NodeJS, etc.
I know mysql_real_escape_string is kind of a pain in the ass. Not to mention a huge WTF. Is the other one fake or something? Still, it's not perfect, but can you do Real Work in it? YES. It's not MUMPS for god's sake.
Non impediti ratione cogitationus.
register_globals hasn't been part of the default PHP runtime since 2002.
see: http://www.php.net/ChangeLog-4...
There are a lot of WTFs to PHP, something that hasn't been true since the first Bush administration isn't one of them.
Non impediti ratione cogitationus.
PHP's biggest problem is lack of modularization and encouragement of inline script hacking. It suffers from SQL that lacks proper commit controls. Implementations I've used leak connections like a seive, forcing restarts of the database servers on a regular basis.
Bottom line: PHP is the one tool I've used that I hate more than JavaScript. JS is functional elegance compared to PHP spaghetti.
I do not fail; I succeed at finding out what does not work.
Until I can get at least a warning on reads to undefined variables I will never use PHP for anything serious again.
Look into ini_set. Specifically 'error_reporting'.
Actually you can....change the error setting level in the php.ini file.....
Have you coded PHP lately?
"no you cannot do anything in PHP that you can do in Python or Perl!"
that statement in itself is true, but PHP is a web language and as for things to do ON THE WEB yes I would argue it is more feature rich.
Even if you disagree with the Python comparison it certainly beats the current state of Perl all the hell.
Source: I've developed in all three for work.
here is where all the fanboys come out. there is a reason PHP is the most popular language on the planet. Easy to learn and gets the job done. deal with it. Use a good framework like Laravel or CodeIgniter and life is good. happy coding.
Don't you mean "mysqli_real_escape_string?"
http://us3.php.net/mysql_real_...
I kinda liked PHP but this stuff started to annoy me. Not only are these methods database specific, but there are tons of deprecated functions in PHP. Sure it's usable - but it's very easy to use functions you're "just not supposed to." Though perhaps that's something they're trying to change as well?
"Ignorance more frequently begets confidence than does knowledge"
- Charles Darwin
As soon as the BASIC ecosystem gets a good templating framework like Twig, a good package management system like Composer or PEAR, convenient SDKs for most cloud providers like AWS or Azure, native support for JSON and easy access to mainstream database drivers (RDBMS and NoSQL), I'm definitely jumping on the BASIC bandwagon!
Seriously, if you compare programming languages based on HelloWorld, it's easy to come out with worthless conclusions such as BASIC > $ANYTHING or $ANYTHING > PHP, but when you have to deliver web solutions quickly for clients who frequently change their mind about fundamental aspects of their business or expect your solution to support the latest fad of the week (be it a new social network or a new trend in web design), PHP is pretty convenient. On the other hand I have yet to find a situation where BASIC would allow someone to solve a real world problem except maybe fixing that bug in Gorilla.bas, which is a bit of an edge case.
lucm, indeed.
Nobody? Look, just because you are either 1) too stupid, or 2) too lazy [or maybe 3) both] to make a website secure does not mean that nobody else is capable.
These languages you are referring to are at least consistent. PHP's only consistency is knowing your going to have to look up what ever method you want to use because there isn't a real naming convention, or even parameter ordering. The other horror of PHP is they throw in features to try to make it look like it has features other languages have. It's like someone says, hey that popular, lets throw it in PHP. Then they do a horrible implementation of it. (See namespacing, PHP OO, etc) Much like basic once had, the only thing it has going for it is its ubiquity.
No excusing PHP. No pretending its just as bad as any other language. It is a horrible nightmare to work with.
You complain about == and === in PHP, but then you bring up a javascript solution (Node.js) as an alternative. This leads me to believe that if *you* decided to rewrite Mt Gox using your beloved Node, another hacker would probably get rich pretty soon. And just as it happened with the PHP version of Mt Gox, the problem would lie in the implementation not in the language.
lucm, indeed.
"It is practically impossible to teach good programming to students that have had a prior exposure to BASIC: as potential programmers they are mentally mutilated beyond hope of regeneration."
"First they came for the slanderers and i said nothing."
There's another (minor) reason to prefix variables with $: That way you can use "reserved" words as variable or field names, say $class, $abstract, etc.
Open Source Network Inventory for the masses! Kuwaiba
Why do I need == and ===?...........My favorite two are Node[JS]
Uh........there's something you need to know about Javascript..........
"First they came for the slanderers and i said nothing."
And I mean an actual alternative with extremely wide-ranging support, ease of deployment in variety of environments (both *nix and windows servers, both dedicated/vps/shared hosting), already has existing large and stable software from framework level to whole off-shelf products for quickly putting a site onto market, large pool of developers, and just generally be production ready, without resorting to deploying your own server and then adding overhead of a system administration? Something actually usable for web-based applications right now for majority of users who just wants something drawn up quick and marketed quickly?
There isn't any beside PHP, and PHP is pretty much the best you have. It can only be a good thing that PHP is improving constantly.
They're driver dependent. If you don't want the mysqli set of methods, don't enable the driver.
Non impediti ratione cogitationus.
A few years ago, PHP had several large frameworks (e.g. CakePHP, CodeIgniter, and so on). Each framework was an island and provided its own implementation of features commonly found in other frameworks.
More like frameworks deliberately exist to create islands with their own implementation of features commonly found in the language itself:
and on, and on, and on...
The headline should read, "Derps fall for new patchwork to solve self-inflicted fracturing problem, film at 11"
In PHP this is now solved with parameterized queries. Plus any framework or CMS worth it's salt was doing it already:
$sql = $dbConnection->prepare("SELECT fname, lname FROM people WHERE id = ?");
$sql->bind_param('s', $id);
$sql->execute();
If you're rolling your own DB connection layer in modern PHP, you're doing it wrong.
I'm out of my mind right now, but feel free to leave a message.....
Hello, JavaScript is object-oriented. This is because, in JavaScript, everything is an object. Period. Loose typing and prototype inheritance do not alter this fact.
And you do not need to decorate your variable names with anything in JS.
Returning to the topic: Back in the day, PHP was sort of awesome for those of us who weren't C or Perl gurus, but those times have passed.
Today I don't use it for anything other than the occasional shell script and simple websites that do not involve the transfer of goods, funds, or private info. But I'm sticking to bash more and more for the former, and I don't do much of the latter anymore.
Il n'y a pas de Planet B.
Rasmus Lerdorf told me at a con some years ago that he was still amazed at how PHP had taken off: "It was just a hack so I could get some things done, and still, that is all it is now, really."
Il n'y a pas de Planet B.
I suggest version numbers, but then they say, "But version numbers don't tell me which one is final". I gave up on them.
I work daily with a codebase full of methods like connect_v1(), connect_v2(), connect_v3(), ... .
You do *not* want to go there. Please trust me on this.
Il n'y a pas de Planet B.
Why in 2014, do I have to decorate variables with '$'?
Not a big fan of variable interpolation, I'm guessing?
Why is the assiciative array syntax take two characters that look a comparison operator?
Don't forget to ask Perl the same question.
Why do I need == and ===?
Because the language is loosely typed. There are other loosely-typed scripting languages that have both of these operators as well.
ANd vaiable confusion between $_GET, $_POST and $_COOKIE
So you would prefer to have them all in one array? Or as global scalars?
Seems to me you're complaining about PHP because it's a scripting language and not C or Java.
Here's a suggestion for you: If you don't like the syntax, or if you want strict typing, use something else. If you don't have a choice in the matter, then maybe you should think about looking for another job. Cheers.
Il n'y a pas de Planet B.
Why in 2014, do I have to decorate variables with '$'?
That is your first complaint about PHP? That? I can't stand PHP but, seriously, that is first on your list of PHP badness?
Maybe he is poor and seeing all those dollar signs depresses him.
I am anarch of all I survey.
Sure, some people lost some bitcoins. But what are those?!?!? Intangible sets of numbers and letters that don't exist in the real world. Not to be insensitive, but boo-hoo!
The bigger tragedy here is that the MtGox site had a vulnerability that has probably been exploited for more than a decade by some nefarious organization to steal peoples' Magic The Gathering Cards. These things exist in the real world!!
$5 / month hosted VPS on linux = awesome!
The problem was that beginners used goto all the time, and would wind up writing crap. They would use goto in places where other data structures should be, and their code became utter garbage. So goto was villified. Now when writing operating system software, there are data structures that are unique to that type of software. Languages may not natively support those data structures, so developers will use goto's to efficiently exit a routine (and some of their routines are very time critical and can also include logic races and bit banging). If you are writing system software, you are writing software at a different level than an application programmer. You likely have the understanding that the data structures provided by high level languages are basically goto's but wrapped in a package that the programmer cannot break (while or do loops compile to a jump or jump-relative which is a machine lanaguage 'goto', and ultimately the binary winds up setting a new address in the instruction pointer (program counter).
BASIC is just imperative programming, and I find it similar to simple assembly programs by the way. It gives you understanding of both and doesn't teach much. C is just BASIC with pointers and functions. :) and why just stop at defaming BASIC. All imperative programming is like BASIC, some will argue functional programming should be taught instead.
Today that "seminal article" would be called a rant
and why just stop at defaming BASIC
He didn't
"First they came for the slanderers and i said nothing."
If you're rolling your own DB connection layer in modern PHP, you're doing it wrong.
The real issue is there's too many PHP shitheads out there still doing it wrong. I just did some maintenance on code that was written in 2012 that had a handrolled db layer full of injection holes. (And a half-assed 'controller' system and all sorts of other common PHP anti-patterns that were popular not more than 5 years ago.)
Note if you google "PHP MySQL" you will get a bunch of tutorials teaching the wrong way to do it even to this day.
And how is this different from "SELECT yada yada " . id . " yada yada"
How exactly does ANY language that allows catenation not allow you to enable sql injection attacks?
"Coders" like you want a language to protect you from being stupid because you are stupid. It is your kind that insists everything be made child proof because you are a child yourself.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
How many of those things are fixable while PHP still remaining recognisable as PHP, or even reasonably compatible with existing code?
And variable-variables. $foo = 'bar'; $bar = 'lol'; echo $$foo;
And a possibility to access variable object properties without having to treat objects like associative arrays or vice versa. $obj->$prop;
I don't see the need for PHP frameworks in the first place. They add zero functionality, they make the code a mess and PHP itself is pretty complete and versatile in the first place.
Every common language out there has ugly stuff of one kind or another.
The usual excuse... Because no language is perfect does not mean we have to use the worst one.
Python has the whole whitespace deal, Perl code tends to be unkempt
Now this is a great comparison. One language is bad because it enforces tidiness, and the other is bad because it doesn't.
Escher was the first MC and Giger invented the HR department.
The real issue is there's too many PHP shitheads out there still doing it wrong.
What I don't get is why the PHP shitheads don't use a framework. I am a PHP shithead so I use Drupal. I know I don't know a lot of PHP. I don't want to. But I wanted something I could conveniently host anywhere and I've got it.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I would say even more. Any language has its weaknesses. Even Great English Language. For example, a tower dispatcher says to pilot: "Turn left. Right now!"
I love Python, I think JavaScript is sort of OK and I did a lot of serious programming in ActionScript 2&3, both of which are quite simular to JS. I was basically forced into doing PHP by the market. I never really liked PHP but I really never hated it either. The thing about PHP is that it's so specific in its domain and such a hack that no one doing PHP development for a living will go around boasting about the greatness of the language. There is a refreshing lack of arrogance in the PHP community which, in my observation, makes it very easy for n00bs to pick up. As a result we get countless people reinventing the wheel in PHP and discovering basic programming patters anew for them selves and starting yet another Framework/CMS/Whatnot and the results often are really bizar. But the community remains alive that way.
F.I. I'm working myself into Drupal at my current employer because it's the prime go-to CMS here. It's like a live alice in wonderland trip. A strange historically grown mess, barely tamed by sanitiy and a relentless chaotic community that all by accident seem to come up with hacks that somehow solve the problem in some way. And yet there's a solid global corporation building its business all around Drupal. The surreal hacks with which the Drupal people solve their problems are mindboggling, and yet everybody seems totally OK with it. And Drupals track record of deployments is impressive.
I guess with PHP it's somehow like the C vs. Lisp argument: C is so shitty compared to Lisp that you have to get yourself together and work as a team, or you won't get anything done. Hence Lisp has this loner exisitance on the side and all the real work gets done in this ancient C thing.
PHP is a simular thing. It is so bad that no respectable programmer would pick it up voluntarly nowadays, but yet it grew out of Perl (which is worse in some ways), was somewhat of an improvement and was at the right place at the right time. The badness of PHP accounts for its considerable lack of arrogance (compare the PHP community to the Ruby community for instance) and for no one feeling guilty when he does a quick bad hack.
As a programmer you don't feel dirty when you do bad programming in PHP, you already felt that when you picked PHP as the solution. Hence quite a bit of work gets done in PHP. That's why PHP has Drupal and Typo3 and Joomla and the Java Community has nothing of that proportions. The barrier of entry into PHP is *very* low which gives it its momentum.
My 2 cents.
We suffer more in our imagination than in reality. - Seneca
Every common language out there has ugly stuff of one kind or another.
The usual excuse... Because no language is perfect does not mean we have to use the worst one.
Exactly the same excuse used by Muslims. "Yes we blow people up, rape, and murder but some Christians did the same thing in medieval times"
Having "several large frameworks" is the biggest problem in software development today. For any problem, there are several large solutions that all do the same thing in different ways, and no matter what you learn to use, the next person always wants the same thing done with a different package. This is not good for programmer's brains, especially coupled with the Cambrian explosion of languages recently. I get to where I can't even remember what language I'm using, since they're all the same but different. (Mostly all using some kind of C or Java syntax, but each different from the other.) No wonder software development is in decline and people are avoiding it as a career or dropping out.
> You mean you suck at writing decent code, without being forced to do things 'properly' ?
You don't always write all the code you use. That's why encouraging* bad code practices the way PHP does is not a good idea.
What do you do when you find a library that does the job but is poorly coded? You are practically screwed. Good luck arguing with your boss that despite that the library works it should not be used. And after you lose the argument, good luck fixing any unforseen bugs that come up.
*I would say "allowing" here, but looking the code snippets displayed all along php.net "encouraging" sounds more apt.
There is nothing ugly in Brainfuck.
Not to be taken the wrong way, but just one minor correction: You can deal with JSON natively in VB.NET :)
Clearly this means BASIC is superior in every possible way (sarcasm)
And there used to be an import_request_variables() function that would allow you to define which request vars (get, post, cookie) you wanted and a prefix for them.
import_request_variables("rvar_","p");
Would make
$_POST['foo']==$rvar_foo
Don't blame me, I voted for Kodos
>Java is fuggin java
As someone currently learning java after 14+ years of PHP coding, what do you mean?
MABASPLOOM!
Unknown to many slashdot posters (apparently).
For about 40 years now:
1) There have been versions of BASIC that can be complied
2) BASIC has had FOR loops, WHILE loops, procedures, and functions
3) Line numbers have not been needed in many versions of BASIC
Sadly, most slashdot posters do not know BASIC beyond GW-BASIC.
BTW: for over 20 years, there have been object-oriented versions of BASIC.
BTW also: other languages also have GOTOs.
BASIC is not perfect, but then, what is?
It's solved everywhere with parameterized queries, but we still get SQL injection attacks since people insist on passing parameters inline. At this point I'm convinced that SQL drivers for scripting languages should simply disallow sending SQL queries as strings and instead have an API to build parse trees programmatically. But of course some laserbrain would insist on adding "parseSQLtext" function...
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
Programming Languages are tools. And tools serve a purpose and are better doing one task than other tools, even those which could be used to serve that task.
I have been coding in PHP for the past 8 years or so. Its really easy to code in PHP, but it has several known flaws which i have to manage to work around.
Last year i got a job that required me to code in Perl. Its ugly as a baboon's ass, but its perfect to work with regex and huge text files.
Recently i have been coding in Python, and its god damn fast! But there are several quirks in the language that i can't stop hating, specially its "We're all consenting adults here" slogan. I have been looking forward to learn Ruby and Java now, or even to get back to my academic days and code something in C/C++
So, stop being a language fanboy, and know your 'enemy' and learn that they are better suited to do some tasks than your favored language.
"life is a joke, and someone is laughing at me"
You are the bad PHP programmer everyone else is talking about.
Wordpress has always been shit code. Javascript has always been Object Oriented. PHP has at least a couple good package mangement systems.
Who said they were bad?
I read TFA and all I got was this lousy cookie
Drupal itself is full of horrific PHP anti-patterns: homebrew sql escape regexes, opaque arrays instead of data objects, using the database to store serialized php objects, ridiculous "hook" request flow processing, etc etc. (Or a least Drupal 6 did, I'm never touching that pileof shit ever again.)
PHP does have a few good MVC frameworks, but the community is split between them and those doing it the buggy old-fashioned ways, so there's no broad consensus on the 'right way to do it'.
I've done PHP for 10 years, and then switched to C#, and I'm never looking back. EVER. Not only is the language shit, but look at the implementation: http://use.perl.org/use.perl.o... If the value of the variable is larger than INT_MAX .... do this... there we go, overflow averted... -_-
Hello RyuuzakiTetsuya, welcome to $_REQUEST
Where $_GET $_POST and $_COOKIE are all mashed together, overwriting each other in an order defined either a system file or by another piece of code that may or may not have executed in this request yet...there is also more than one config option that effects it too.
This article explains why: http://me.veekun.com/blog/2012... I've since moved onto Python for all new webdev projects.
> It was just a hack so I could get some things done, and still, that is all it is now, really.
Same thing can be said of a nuclear reaction. Demonstrably, intent has no impact on efficacy.
What we all really want is a language that fits our own head, not somebody else's head.
Table-ized A.I.
Drupal 7 and 8 got a lot better.... but Drupal does have a lot of that stuff as legacy specifically because they were working around those kinds of limitations in older versions of PHP. Switching out those patterns across something as big as Drupal is a massive undertaking that fundamentally changes how Drupal works.
I'm out of my mind right now, but feel free to leave a message.....
A Bloat-A-Matic? Like this?
Normal:
A = B + C * D
Bloated:
adder = new Adder(new FloatManager())
multiplier = new Multiplier(new FloatManager())
temp = new Float()
result = new Float()
temp.setValue(multipler.multiply(C, D))
result.setValue(adder.add(B, temp))
Table-ized A.I.
I use digitalocean for my web hosting and several other things. It's a really nice platform.
> And you do not need to decorate your variable names with anything in JS.
What is the proof that one way is better than another and what is the metric for "better"? If you want to talk about languages from an engineering standpoint... like everything in javascript is an object in practical sense (truly oo), then you have to rationally be able to explain why a variable identifier is bad and what bad is supposed to mean.
I happen to think an identifier is preferred. I'm trading mandatory (syntax) keystrokes for valuable information. Type systems reduce bugs at the cost of abstraction complexity. So I'm biased toward always using as much type information as possible.
For interpolation of strings (still important to PHP's design), identifiers make sense. In javascript you have to have a library to do an application/library dependent search and replace syntax. I'll take consistent PHP templates over JS templating anyday.
So don't use $_REQUEST.
If you absolutely have to pull something out of a POSTed form, use $_POST.
Non impediti ratione cogitationus.
and still are
Table-ized A.I.
I was not offering a value judgement. I was merely stating facts.
FWIW, I have more than a decade of experience using both languages, have written well-received books on both of them, and I like and dislike each of them for various reasons.
Il n'y a pas de Planet B.
I agree completely back in the 4.x days, even early 5.x, But since 5.3 I think they are actually starting to develop the language seriously. The main problem is you have a TON of code out there, so you REALLY have to think of the risks, pros, and cons of doing a BC break. Really what they should do is just make version 6 already FIX all of the bullshit in the language and not care about the many many BC breaks. Actively release fixes for 5.x branch for a few years while people transition to the 6.x branch
> One language is bad because it enforces tidiness
When you have to scroll sideways to look at your code because of all the tabs, it's an aesthetic issue that encumbers a potentially great language.
Java is fuggin java
As someone currently learning java after 14+ years of PHP coding, what do you mean?
Most criticisms vary depending on prior language experience. For example, someone coming to Java from a primarily C++ background might criticize Java's lack of operator overloading, while someone coming from a primarily OCaml background might criticize Java's severely limited type inference. These criticisms are often highly subjective; for example, whether or not operator overloading is a desirable language feature is a hotly debated topic on its own.
Some criticisms of Java can be considered to be objectively valid, such as specific cases of needlessly verbose language syntax, or the annoyances associated with interfacing to native code through JNI or JNA.
There can also be non-technical, sometimes purely emotional, criticisms. Some people despise Oracle, and therefore Java by association ever since Oracle bought Sun and acquired Sun's rights to Java. Some people deride Java as a "modern COBOL".
- T
Until they toss out all the bullshit, start fresh PHP is not worth using in any use case.
They don't have anything like Rack yet, which is the #1 thing that makes Ruby for web usage so awesome.
Just because all languages have flaws that does not mean that all languages are equally flawed.
PHP flaws >>>>>>>>>> <insert any non-esoteric language here>
Rasmus couldn't figure out how to write a parser to detect variables without appending a $ on it. There is no other reason.
At least other languages that have sigils in variable names exist for semantic reasons, not to make your crappy parser happy. For example Ruby, $, @ and @@ all have semantic meaning as do variable that have no sigil.
"Bloat" is unnecessary code that makes a program run slower. Your example is not bloated, just verbose. Given a suitable wire API, it'll likely run faster than parsing SQL requsts sent as text strings. Also, do note that dynamically building complex expressions is far more convenient when you can treat subtrees as objects. Building strings representing complex logic programmatically quickly becomes a complete mess.
However, if you really want to compile said text strings while serving user requests, do something like
compiled_sql = sql_compile("Select blah blah")
And have sql_compile throw an exception if the expression contains string literals. In other words, remove the ability to use anything but prepared statements and the ability to use string literals in said prepared statements, and SQL injection attacks go away.
Verbose, and ridiculously so. Do you think intentionally making up a convoluted interface refutes anything? Especially since you're applying an API meant for preventing SQL injection attacks to mathematical expressions, where it's presumably impossible to wreak havoc no matter what values of B, C or D you supply.
Well done, the man of straw is dead.
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
PHP is getting better but still has a long way to go before I can say I would choose it over other languages. Besides many of the things already mentioned here, I have a few more basic gripes with the language, namely its community/"ecosystem", Composer, namespaces and autoloading. I wrote about it in more detail and as expected (unfortunately), it generated lots of criticism from some fan boys, as well as some other more rational defensive comments from not-so-fired-up readers. I also wrote about what I consider to be the mentality of these folks who defend PHP as if their life depended on it, and how I hope they someday can see the light.