Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP the Wrong Way

phpthewrongway.com

Post reply on HN
Print view View original

111–120 of 194 posts

Re: PHP the Wrong Way

#111

Post by robert_tweed »

tclancy wrote: post #101
robert_tweed wrote: post #67

Earlier quoted context omitted.

You can also build horribly insecure applications with a framework. A framework does not absolve you from thinking, which seems to be the point the author is making. There's a difference between frameworks and libraries and of course it is a good idea to use trusted crypto implementations and avoid NIH syndrome, but a large part of security is including it in the design process from the start. You can't just assume "…

The jack of all trades is the master of none. Almost no generalist is going to be good enough to properly handle all security concerns. I like knowing my framework is constantly upgrading password handling, XSS attack prevention and things I haven't even heard of yet. The fact you can build insecure things in a framework isn't an argument against it and why would someone who builds a horribly insecure app in a framew…

They probably wouldn't, but that's neither something I said, nor is it the article's premise.

However, a framework does increase the attack surface, which is something that should be taken into account. If you save 20 lines of code by adding a 100,000 line framework, you need to ask yourself which of those is most likely to contain a bug?

Plus, bugs in popular frameworks tend to get exploited in practise. Other bugs less so, because of the need to first find the bug. The odds of that happening will increase if the bug is common and obvious, or you are a particularly high-value target. By using a framework you effectively increase your value as a target to the sum value of all projects using that framework. This becomes especially bad if the framework stops being maintained, because the value to an attacker isn't lost as quickly.

The above also applies to libraries, but libraries tend to be more focused and more stable than frameworks, since frameworks tend to "go stale" if not continually updated in a way that most libraries do not.

Re: PHP the Wrong Way

#112

Post by MustardTiger »

V-2 wrote: post #107

Why learn frameworks when you can build everything from scratch and become a true carpenter ( "building software using general purpose frameworks doesn’t make you a coder or a programmer any more than putting together a pre-built house makes you a carpenter" ). "These people [framework creators] seems to be infatuated by the though of having other people follow their “way of doing things”, becoming some kind of PHP c…

I wonder why this mentality only exists with web devs. Everywhere else, someone writing software is considered normal, not some scary problem. Nobody sees any other kind of application written by a previous programmer and cries "oh no! I am entirely at the mercy of this previous programmer! If only they had used one of the dozen competing frameworks this tragedy could have been avoided.". It is just normal. Perhaps the low barrier to entry and corresponding low average experience of web developers plays a part in this mentality.

Re: PHP the Wrong Way

#114

Post by CiPHPerCoder »

nercury wrote: post #86

It is near impossible to write "Modern" PHP and achieve good performance. On every request, PHP reads and parses every file that is referenced somehow. It is in direct contradiction to the language constructs the PHP itself provides - especially Exceptions, Interfaces and Inheritance. People want to use these features, because they help design better systems, where the concerns are separated, and features are plugins…

> So, to sum up, the author here is right: this is insanity, until PHP provides a module system that can handle PHP abstractions.

I suspect you're being downvoted because we have this: https://getcomposer.org + https://secure.php.net/manual/en/language.oop5.abstract.php

Re: PHP the Wrong Way

#115

Post by CiPHPerCoder »

greyman wrote: post #90
iopq wrote: post #54

Earlier quoted context omitted.

They removed mysql_real_escape_string function so that you can use mysqli_real_escape_string http://php.net/manual/en/mysqli.real-escape-string.php

No, you use PDO::quote().

No, you use

  $pdo->prepare("SELECT id FROM foo WHERE bar = ? AND baz = ?")
      ->execute([$baz, $qux]);
...while taking care to set PDO::ATTR_MODE to PDO::ERRMODE_EXCEPTION and PDO::ATTR_EMULATE_PREPARES to false when your PDO object is initialized.

https://github.com/paragonie/airship/blob/8b7edde11b5b57fcb4...

See also: http://stackoverflow.com/a/12118602/2224584

Re: PHP the Wrong Way

#116

Post by nilved »

andyfleming wrote: post #66
omginternets wrote: post #62

Is it me or is the author confused about the distinction between a library and a framework? To me, a framework implies inversion of control: you don't call the framework's code; the framework's code calls your code. Granted, he skirts the issue with phrases like "A framework is a system that helps you build software, but at the same time it forces you to work within the limitations and restrictions of the framework i…

No, you are correct. Most developers today would understand a framework includes your code, as where with libraries, your code includes them.

I think that's generally a good heuristic but fails in a lot of cases. The distinction between frameworks and libraries is murky and mostly semantic.

Re: PHP the Wrong Way

#117

Post by Olap84 »

fredleblanc wrote: post #82
Olap84 wrote: post #8

Earlier quoted context omitted.

What I take from is not to use PHP, which I do as it pays the bills, but why would anyone choose it for a new project baffles me. This article doesn't help it.

I love PHP. It feels like a complete toolbox to me, whereas other languages like Python or Ruby feel like I'm buying an entire Home Depot for every project. Sometimes you need the whole store. Most times I don't. I think the OP has some good points about reconsidering the standard answers that everyone gives to questions when asked. There are no silver bullets in web, but many things sure are treated like them. Maybe…

Well I certainly agree with the right tool for the right job. And PHP has some roles. My point was more about the article, which would, imo, put programmers off PHP with its contrariness and smugness.

Re: PHP the Wrong Way

#118

Post by romaniv »

V-2 wrote: post #107

Why learn frameworks when you can build everything from scratch and become a true carpenter ( "building software using general purpose frameworks doesn’t make you a coder or a programmer any more than putting together a pre-built house makes you a carpenter" ). "These people [framework creators] seems to be infatuated by the though of having other people follow their “way of doing things”, becoming some kind of PHP c…

> The problem is, if I inherit an application created with a well-known framework, I'll have a much easier time figuring out what is what, and looking for answers when something goes awry.

Unless they spend most of their code fighting the framework to accomplish their actual task. Which happens rather often.

Not to mention that learning a new framework is not fundamentally different from learning some person's approach to doing things. Whether or not it's easy depends on the quality of code and documentation. Given equal size of the code that does the job, reasonably written framework-free code is probably going to be easier to understand, because it doesn't have external dependencies.

I never understood why after years of dealing with dozens of competing and rather poorly constructed web frameworks in Java, PHP and now JavaScript people still believe that those things have some kind of inherent value. Remember Struts, anyone? PHP Nuke? WebForms? Would you rather maintain something that used either of those over something that was written in vanilla Java/PHP/C#?

Re: PHP the Wrong Way

#119

Post by efficax »

This is why I don't use Cocoa to write iPhone apps, or Swift, but ARM assembly. True carpentry! Jesus was a carpenter too, and God spoke the machine code of the universe.

Re: PHP the Wrong Way

#120

Post by kyberias »

The usage of that Paul Graham quote is hilarious. The author misses the point entirely! Graham uses the word pattern to describe a repeated piece of code that matches a pattern. And it's a sign of trouble: a violation of the DRY principle. Nothing to do with design patterns really. Are all the other quotes used as unsuitable, we don't know.
Post reply on HN