Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP Sucks

evertpot.com

Post reply on HN
Print view View original

281–290 of 297 posts

Re: PHP Sucks

#281

Post by dnet »

CiPHPerCoder wrote: post #106
dnet wrote: post #87

Earlier quoted context omitted.

My company does penetration testing and most of the projects involve web apps. Our clients use PHP, J2EE and .NET, and after 7 years of operation, we clearly see a trend where the number and severity of security issues are highest in PHP apps, lowest for .NET, with J2EE in the middle. Of course, there's the odd secure PHP app and the .NET project with gaping holes, but the trend is obvious. So it's not peer pressure,…

Please tell me more about these PHP projects, if you have the data available to you. * Did they support EOL'd versions of PHP? * Are they legacy WordPress/Drupal/Joomla projects that haven't been updated in years? * Are they in the "we (didn't use a framework|rolled our own framework) and used the mysql_* functions" league? * Did they attempt to do something weird/crazy (i.e. store all session state in an encrypted c…

I know little about most of them, since we did penetration testing (simulating what could an attacker over the 'net do) most of the time, as few of our clients have the budgets for a proper source code review. No CMSs were used, we had one Wordpress, but that was actually almost perfect, since they kept it up to date. These projects were custom-made business applications, not "dynamic" web sites.

Frameworks were sometimes used, although their effect on security is somewhat baffling at first sight -- and this is regardless of the platform, although we found most issues with PHP and J2EE. Sure, when you use the framework for security-critical things such as constructing SQL queries (SQLi) or HTML output (XSS), things work quite well. However, since most developers don't think about these issues, the single time they have to "escape" from the framework, since it doesn't (or they just think it doesn't) support a certain scenario, they don't know about all the things PHP and in smaller ways, J2EE requires to do for security.

Of course, this way, the framework protects 9x% of the application, but the asymmetry of security is that the attacker only needs a single vulnerability while the defender must patch it all.

Re: PHP Sucks

#282

Post by collyw »

27182818284 wrote: post #52
emodendroket wrote: post #15

Earlier quoted context omitted.

If you're doing it as a job, though, you probably end up having to work on a lot of legacy codebases with the old issues.

That, and I've noticed that the typical legacy PHP codebase is worse than the legacy codebase in other stacks.

I have seen some real crap in Python recently. Then I was asked to move a PHP app to a new server. A quick look at the code looked terrible - string concatenations for all the SQL. (Does PHP provide some way of making this safe, or should I warn management about potential SQL injection? I don't know a lot about PHP).

Re: PHP Sucks

#283

Post by syzer »

pstadler wrote: post #208
segmondy wrote: post #142

Earlier quoted context omitted.

It's not hard to write structured elegant php, that is horseshit. Please look at code for symfony or laravel. Hell, my annoyance with writing good code in PHP is that it ends up looking like Java, which begs the question, why not just do it in java. https://github.com/symfony/symfony/tree/master/src/Symfony or you can look at simpler sample codes I wrote for a class in design patterns with php https://github.com/segm…

Symfony is the worst thing that could've happened to PHP. Dependency injection with varying degrees of XML/YAML madness everywhere. It's terribly slow and pretty much unusable w/o several caching layers in front. I can honestly say that I hate this framework with a passion, and the language too. PHP's core and a big part of the community is copying features and methodologies from Java, but they will never get close t…

I think that Symfony is SpringMVC for poor, and slower, and crappier.

Re: PHP Sucks

#284

Post by spriggan3 »

nikdaheratik wrote: post #275
spriggan3 wrote: post #212

Earlier quoted context omitted.

> Right, and who's paying me to work with one of those alternatives? No one. Give me a break, it's not like there are only PHP jobs out there. If you can't find anything else then it's because you're not capable of coding something that is outside PHP domain, IE basic CRUD apps ..

Umm... outside of R&D or the valley, the breakdown is something like: PHP: 30%; .NET for finance/enterprise: 25%; Java for finance/enterprise: 20%; Java for android: 10%; iOS: 10% (~5% overlap); Everything else: 10%. And as far as payscales go, PHP is nearly always > the "Everything else" unless it's super specialized. But clearly everyone paying median or above for PHP is getting conned and they should convert their…

> Umm... outside of R&D or the valley, the breakdown is something like:

citation needed, I don't believe one second these figures are accurate.

Re: PHP Sucks

#285

Post by supbpeerr »

dpcx wrote: post #181
supbpeerr wrote: post #101

Earlier quoted context omitted.

Used to love Laravel, until I learned the hard way it is utterly impossible to debug when shit do hit the fan. Some related discussion here: https://laracasts.com/index.php/discuss/channels/general-dis...

I'd love to hear an example of "utterly impossible to debug." I've debugged many a Laravel application, during production outages and otherwise.

check the link for examples. for example, a typo in a variable name in a view gives fully unrelated stack traces.

Re: PHP Sucks

#286

Post by CiPHPerCoder »

dnet wrote: post #281
CiPHPerCoder wrote: post #106

Earlier quoted context omitted.

Please tell me more about these PHP projects, if you have the data available to you. * Did they support EOL'd versions of PHP? * Are they legacy WordPress/Drupal/Joomla projects that haven't been updated in years? * Are they in the "we (didn't use a framework|rolled our own framework) and used the mysql_* functions" league? * Did they attempt to do something weird/crazy (i.e. store all session state in an encrypted c…

I know little about most of them, since we did penetration testing (simulating what could an attacker over the 'net do) most of the time, as few of our clients have the budgets for a proper source code review. No CMSs were used, we had one Wordpress, but that was actually almost perfect, since they kept it up to date. These projects were custom-made business applications, not "dynamic" web sites. Frameworks were some…

Groovy! Thanks for the insight.

I'm not surprised to hear that custom-made business applications fared so poorly. Back when I worked for a telecommunications company, I saw some of the worst code imaginable endorsed by corporate and deployed to production with wild abandon. I reported no less than 10 vulnerabilities in my first day with a new codebase and they were all ignored. My boss took me aside and said, "There's some politics going on right now, just keep that in your back pocket in case you need to bring it up later. Now's not the time."

Re: PHP Sucks

#287

Post by emodendroket »

swalsh wrote: post #57
emodendroket wrote: post #19

Earlier quoted context omitted.

That sounds like more a company/environment issue than an issue with either language.

The thing is different languages lend themselves to different processes. Let's say you have the exact same bug in a web app, maybe you need to modify the where clause in the data layer of the app (or something small like that). In the C# version, you'll have to compile it and then push it. Maybe recycle the pool depending on factors in the architecture. In PHP, you just modify the file and throw it out there. Because…

At my last job we were on Azure and publishing was like a two-click affair.

Re: PHP Sucks

#288

Post by emodendroket »

collyw wrote: post #282
27182818284 wrote: post #52

Earlier quoted context omitted.

That, and I've noticed that the typical legacy PHP codebase is worse than the legacy codebase in other stacks.

I have seen some real crap in Python recently. Then I was asked to move a PHP app to a new server. A quick look at the code looked terrible - string concatenations for all the SQL. (Does PHP provide some way of making this safe, or should I warn management about potential SQL injection? I don't know a lot about PHP).

I think PDO is the accepted way to do it but I'm not a PHP developer.
Post reply on HN