Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP the Wrong Way

phpthewrongway.com

Post reply on HN
Print view View original

41–50 of 194 posts

Re: PHP the Wrong Way

#41

Post by cowsandmilk »

sametmax wrote: post #24
RyanZAG wrote: post #20

Earlier quoted context omitted.

You may be drowning in the kool-aid. It is very easy to write tiny secure code in PHP without a framework. Of course if you're building a social network, then it will run into some of those potential security issues. But for most of the small problems you're using PHP to solve, you really don't need to be a security expert as long as you're not piping user input directly to your database or OS. It's kind of the point…

No it's not easy. You need to be sure you escape everything, setup a mecanism for allowed host, CSRF, anti click-hijacking and of course ensure your auth workflow is nicely designed. And that supposes that not only you know about it, but also how to implement it properly. Not to mention the time to code it, document it, test it and maintain it. Most custom PHP site I encounter are full of gigantic holes. And then oth…

> And then other developpers comes in, and have to learn how to use your non standard code

If you use a framework, new developers coming in often have to learn how to use it as well.

I've never hired a developer who didn't know how to use PDO prepared queries, which are the standard in my code base. Built into the language, escapes no matter what database you use, etc.

Good developers know how to write secure PHP code without a framework. They don't necessarily know how to use a random framework.

Bad developers will at some point take variables from a $_POST/GET array and use them unwisely regardless of whether you have a framework.

Re: PHP the Wrong Way

#42

Post by spriggan3 »

RyanZAG wrote: post #35
sametmax wrote: post #24

Earlier quoted context omitted.

No it's not easy. You need to be sure you escape everything, setup a mecanism for allowed host, CSRF, anti click-hijacking and of course ensure your auth workflow is nicely designed. And that supposes that not only you know about it, but also how to implement it properly. Not to mention the time to code it, document it, test it and maintain it. Most custom PHP site I encounter are full of gigantic holes. And then oth…

If its under 50 lines of code for some simple processing, I don't think another developer who comes in would have much trouble. Of course if that 50 lines of code is now 250 because it tries to get around a framework, then instead of finding a PHP developer to help out on the code, you now need a $framework developer. Basically, don't use a framework unless you really do need all the features it gives you. Don't just…

> If its under 50 lines of code for some simple processing

It doesn't matter how much lines you write. It has nothing to do with the number of lines but the functionalities and how many developers review that piece of code. Furthermore more a third party codebase is usually the code you don't have to test. You keep on talking about frameworks like it's a bad thing, but all frameworks are not equal in size nor features.

Re: PHP the Wrong Way

#43

Post by mgkimsal »

Shanea93 wrote: post #33
pc86 wrote: post #28

Earlier quoted context omitted.

99% of people who get paid to write PHP do not have the requisite level of patience, process, or experience to write a fibonacci method let alone write "truly beautiful" PHP.

It's really easy to make up statistics on the spot with absolutely no source. I very much doubt that people would be getting paid to write any code if they couldn't implement a single for loop in their primary programming language.

a "single for loop" and a "fibonacci method" are different enough.

there are loads of people who take money for working in PHP, and they're closer to pc86's view of things than yours. I wouldn't say "99%" but... there's a lot. A LOT. I've run (and attended) several local tech meetups in my area, and ... there's a huge amount of technical talent, but also a surprising number of people bumbling around with wordpress, drupal and other systems. They generally don't have a clue what't they're doing with respect to PHP code, but they make a living modifying themes by cut/paste stuff from forums.

Re: PHP the Wrong Way

#44

Post by arien »

yedpodtrzitko wrote: post #4

I just skimmed the website, and I am still not sure if it's meant seriously or if it's some kind of joke? Feels a bit contradictory eg. "dont use framework" vs "make software secure by default". Isn't a security one of the gains of using frameworks, beside other things? You would need to be a security expert to cover all potential security issues when writing something from a scratch.

If you marry yourself to a single framework you remove a lot of degrees of freedom from PHP (which might be good or bad depending on the case) and introduce a set of rules that might or might not all be good for you.

It might save you time, initially. But at some point you will have to sit down and learn what the framework is actually doing behind the scenes (is it really secure? why is it so slow? I really need to implement this obscure, unsupported by my framework, thing), and you might not be so happy about your choice. Thinking about this ahead of time will save you headaches in the long run.

Think of PHP as sandbox programming. Such an open language, there is a lot of freedom, so many ways to achieve a specific result. The takeaway from the article is that "always do X" shouldn't be a thing, considering a) the vast possibilities and b) your purpose. Frameworks might be too much bloat, patterns should happen naturally, not forcefully. Security should be paramount, but it shouldn't be a blackbox behind third party code, you should be able to explain how you are protecting your users. Etc.

This is not a "don't use a framework/standards/etc" rant. I see it as a reminder to double-check if the current... trends/standards? match your actual needs and wants.

Re: PHP the Wrong Way

#45

Post by spriggan3 »

throwaway1974 wrote: post #14
bad_user wrote: post #7

Earlier quoted context omitted.

The very existence of PHP is a contradiction, so I wouldn't sweat to much about it. But speaking of boolean logic, negating "always use a framework" does not yield your interpretation.

"The very existence of PHP is a contradiction" Uhm no for me coming from a C background I love PHP since its basically C with a lot of the boring/repetitive stuff abstracted away Good PHP code exists, it only got a bad name due to "web developers" with no formal programming education stumbling across PHP and going "aha this can generate my html etc" and then proceeding to make a pile of mistakes. PHP is a hammer, bla…

> Good PHP code exists, it only got a bad name due to "web developers" with no formal programming education stumbling across PHP and going "aha this can generate my html etc" and then proceeding to make a pile of mistakes.

It got a bad name due to the weird nature of PHP which is still a template engine , no matter how much features you had on top. It's like developing webapps in pure HAML, Jinja or Handlebars.

PHP also has a lot of bad design language wise, due to the incompetence of its creator and early maintainers when it comes to language design.

Re: PHP the Wrong Way

#46

Post by PolCPP »

sametmax wrote: post #29
pc86 wrote: post #27

Earlier quoted context omitted.

I think RyanZAG was referring to solving one small problem with a PHP script. That does not necessitate a web page or any of the security mechanisms you suggest.

There is no such things as a "general purpose" framework anyone would use for such a small script. This would make no sense.

Also, he mentions that company uses framework, won't scale and start ripping it apart to take unnecesary parts. You don't do that for a 50 line script

Re: PHP the Wrong Way

#47

Post by corobo »

vlunkr wrote: post #18

So if I was starting a new project now, I shouldn't use a framework or any pattern too strictly, so.. what do I do? Following this logic will give me spaghetti code and reinvented wheels. If there are some basic patterns to follow they should be included here.

My feeling is I should just start coding with whatever I know and not bother getting involved in arguments about the underlying language. Time is money friend!

Re: PHP the Wrong Way

#48

Post by kijin »

mgkimsal wrote: post #39
stephenr wrote: post #37

Earlier quoted context omitted.

> currently accepted best practice for autoloading According to who? FIG? Are you aware that php has a built in auto loader that supports namespaces and is written in C? > compose projects based on the packages they need. Ah, the NPM/Composer golden brick road to development. Aka, the "I don't know what this is but I'm gonna lick it" approach to development, where you end up with 50 "micro-frameworks" or "utility lib…

> Are you aware that php has a built in auto loader that supports namespaces and is written in C? What are you referring to?

Probably spl_autoload [1].

[1] https://secure.php.net/manual/en/function.spl-autoload.php

Re: PHP the Wrong Way

#49

Post by Shanea93 »

pc86 wrote: post #40
Shanea93 wrote: post #33

Earlier quoted context omitted.

It's really easy to make up statistics on the spot with absolutely no source. I very much doubt that people would be getting paid to write any code if they couldn't implement a single for loop in their primary programming language.

PHP was the first language I ever used professionally. The code I wrote - the code every single one of my colleagues wrote - was atrocious. We were paid bottom dollar ($30k in 2008) to write absolute shit code. The PHP community in my area was the same. All newbies, all paid barely more than a fast food manager, all writing code that could be taken down by a HS student with Fiddler. I'm sure different experiences exi…

And since then tools such as Composer and Symfyony3 have been released. It's been almost 10 years. Hell, even Magento2 isn't that bad, if you can look past the awkward dependency injection they're in the process of fixing.

PHP in 2008 is very different to PHP in 2016. PHP frameworks in 2008 are very different to PHP in 2016. PHP developers in 2008 are very different to PHP in 2016.

Re: PHP the Wrong Way

#50

Post by mgkimsal »

pc86 wrote: post #40
Shanea93 wrote: post #33

Earlier quoted context omitted.

It's really easy to make up statistics on the spot with absolutely no source. I very much doubt that people would be getting paid to write any code if they couldn't implement a single for loop in their primary programming language.

PHP was the first language I ever used professionally. The code I wrote - the code every single one of my colleagues wrote - was atrocious. We were paid bottom dollar ($30k in 2008) to write absolute shit code. The PHP community in my area was the same. All newbies, all paid barely more than a fast food manager, all writing code that could be taken down by a HS student with Fiddler. I'm sure different experiences exi…

PHP is so vast that it's a ghetto, the rich uptown area, a sprawling suburban middle class, and more.

I share some of your experiences - I'm disturbed by how easy it is for people without basic coding knowledge to make money "building php websites". But I also see and run in to a large number of people who can do fantastic PHP code (testable, documented, clean, modular, etc).

One thing I've noticed is that most of the people who can do good PHP code (at least in the sense that it's not crappy) have also worked in other languages/tech, either before or during their PHP work. I know the exceptions, but for the most part, someone's PHP code quality is higher if they've done more than just PHP.

Post reply on HN