Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stack Overflow: Defend PHP - convince me it isn't horrible

stackoverflow.com

Post reply on HN
Print view View original

31–40 of 74 posts

Re: Stack Overflow: Defend PHP - convince me it isn't horrible

#31

Post by mfukar »

pierrefar wrote: post #17

I think this is the wrong approach. The guy should try to convince me that PHP is bad. That PHP has never not did what I wanted it to do. That I need to invest time and switch to some other language because it's better for my needs and purposes, and the switch will quickly get me to a level of expertise that I have with PHP now. The fact of the matter is PHP is ugly and that's really it. I can live with ugly because…

The guy should try to convince me that PHP is bad.

It goes both ways: he has tried to do certain things with PHP and made his life miserable; you've done certain things with PHP that made your life easier.

Telling each other which is which will let the one know what to avoid and the other one what's he doing wrong.

Anyway, it's about time we started thinking and being more mature than 'my language is better than yours'. Which is why I hate all similar postings and articles which aim to enlighten me On the Amazing Features Of Language X (or the opposite).

Re: Stack Overflow: Defend PHP - convince me it isn't horrible

#32

Post by mfukar »

pilif wrote: post #13

I'm spending most of my time maintaining a web application consisting of around 150k lines of PHP code. We (well - initially, it was just me) began development back in 2004 but since then the application has grown constantly. Back in 04, I already felt some reservations against PHP, but that's what I knew best and that's what was most used for the web (Rails might have been around, but not really known - other ruby o…

It's just as secure as any other language you can write insecure code in (i.e. all of them).

That may be true; I've only developed two half-serious projects in PHP a while back. But given the amount of XSS and injection vulnerabilities we're seeing daily, I think that something is wrong with those web development guys. PHP is admittedly a widely used tool and I can't help but wonder: "Could it be just the language? Is there a possibility things would be better if PHP was abandoned?". Of course things would improve if we educated all PHP developers on the security implications of whatever it is they're programming. But so many years of coding have shown it's infeasible (for any language).

Re: Stack Overflow: Defend PHP - convince me it isn't horrible

#33

Post by sandGorgon »

Drupal, Joomla, Wordpress, phpbb, vbulletin, invision power board:: Together they are 99% of online communities + personal websites. If you want to use any of them. Then it is php.

I may not particularly like PHP, but to deliver projects in reasonable time, you may have to leverage PHP

Re: Stack Overflow: Defend PHP - convince me it isn't horrible

#34

Post by shabble »

hackermom wrote: post #11
hsarvell wrote: post #4

PHP is great if you need to get some small thing up and running yesterday. PHP is also great if an out of the box solution will almost fit the bill due to the fact that there are so many. Just take a box and do some small modifications, voila, done!

Like someone else already said, "small thing"... like Facebook? Like Flickr? Like Wikipedia? Like Digg? :)

It's probably fair to say that all of these started out pretty small (and quite a lot time ago). If you're a one-man company with a great idea and possibly not a huge amount of programming experience, then PHP is a fair choice for prototyping your design and getting things off the ground.

Then, when you realise it's a runaway success and all the investment starts piling on board, the last thing you want to do is stop and tread water for 6 months whilst you rewrite everything (introducing a whole new set of problems as you do), just to get back up to where you are now, before adding those new features.

So, arguably these sites are successful because of their ideas, and the fact that they use PHP is more likely a historical accident than a carefully considered decision, at least in terms of their codebase.

To put a positive spin on it, you could argue that their early choice of PHP is what allowed them to become successful by letting them get their ideas out, rather than the best technology for a internet top-100 site or whatever.

Re: Stack Overflow: Defend PHP - convince me it isn't horrible

#35

Post by generalk »

mfukar wrote: post #32
pilif wrote: post #13

I'm spending most of my time maintaining a web application consisting of around 150k lines of PHP code. We (well - initially, it was just me) began development back in 2004 but since then the application has grown constantly. Back in 04, I already felt some reservations against PHP, but that's what I knew best and that's what was most used for the web (Rails might have been around, but not really known - other ruby o…

It's just as secure as any other language you can write insecure code in (i.e. all of them). That may be true; I've only developed two half-serious projects in PHP a while back. But given the amount of XSS and injection vulnerabilities we're seeing daily, I think that something is wrong with those web development guys. PHP is admittedly a widely used tool and I can't help but wonder: " Could it be just the language?…

Is there a possibility things would be better if PHP was abandoned?

Nope. Beginning coders write vulnerabilities until they're otherwise educated. In PHP these are SQL injection and XSS holes. In C they're buffer overflows.

Of course things would improve if we educated all PHP developers on the security implications of whatever it is they're programming. But so many years of coding have shown it's infeasible (for any language).

Education is feasible for any language. Some segment of the programming population will always remain uneducated -- laziness or apathy on their part -- but this doesn't mean education doesn't work.

Re: Stack Overflow: Defend PHP - convince me it isn't horrible

#36

Post by byoung2 »

This debate reminds me a lot about another debate about language. When I studied English in college, I occasionally came across papers enumerating the weaknesses of the English language. It's terrible for writing poetry, because you can't rhyme like you can with Italian or seduce like you can with French. It's difficult to learn, because of irregularities in spelling and pronunciation.

Now that I'm a PHP developer, the response I give when people ask me why I use PHP and not a "real language" is the same one I would give if someone asked me why I speak English. There are more people who speak my language. If I travel to a remote fishing village in China, chances are I can find one person who speaks English. Try to find someone who speaks Italian. When I'm working on a web project, I know that if I write it in PHP I can find hundreds of developers to hire at a reasonable price versus hunting around for Ruby developers (who cost double).

At my day job, we run 200 websites, and 194 of them are written in PHP (1 is Java, 2 are .NET, 1 Ruby, 2 Coldfusion). When the company buys sites, the first step is converting them to PHP (if they aren't already), just so future maintenance is easy and cheap.

Re: Stack Overflow: Defend PHP - convince me it isn't horrible

#37

Post by hnal943 »

raganwald wrote: post #24
ndimopoulos wrote: post #21

To answer to the topic of the post - why should I (or anyone else for that matter) bother trying to convince the author that PHP isn't horrible. If the author does not think that PHP is suited for his/her needs then he/she should not use it. There is a plethora of programming languages out there - pick and choose. The post has a disconnect between the title and the content. The author does not want to use PHP and tri…

My friend Anthony Lewin and I were Macintosh salespeople back in the Dark Times when Jedi Master Jobs was in exile. People would walk in to the store and ask the same question: Convince me: Why should I buy a Mac instead of a PC? Anthony quickly learned not to feed the trolls. He would say "I don't know. Why would you buy a Mac instead of a PC? Most people buy PCs. What's so special about you that you need what a Mac…

Doesn't this fit more appropriately the other way around?

"I don't know. Why would you use a language other than PHP? Most people use PHP. What's so special about you that you need what another language has to offer?"

In your example, the PC is the inferior but nearly ubiquitous (and easier) choice. Isn't that the position PHP is in as well?

Re: Stack Overflow: Defend PHP - convince me it isn't horrible

#38

Post by lhorie »

weego wrote: post #15

These topics always just smell of "Now I'm a grown up programmer I'm going to tell the world how much I understand by slamming an easy target language". I love PHP and have used it for years since moving away from asp.net and agree with some of the posters arguments as a theoretical principle, but as day-to-day PHP developer I also say so what. Naming and parameter inconsistencies? Yes, my libraries have that too and…

Agreed. Fwiw, many of the complaints apply to other "better" languages also:

- PHP has inconsistent naming of built-in and library functions. - C has types like int, size_t, jmp_buf and FILE

- PHP performance is abysmal without caching - MRI Ruby is pretty slow too

- Functions are case insensitive - Lisp anyone?

etc etc

The whole meme of PHP warts seems more like an exercise in confirmation bias than objective analysis.

Re: Stack Overflow: Defend PHP - convince me it isn't horrible

#39

Post by rick888 »

shabble wrote: post #34
hackermom wrote: post #11

Earlier quoted context omitted.

Like someone else already said, "small thing"... like Facebook? Like Flickr? Like Wikipedia? Like Digg? :)

It's probably fair to say that all of these started out pretty small (and quite a lot time ago). If you're a one-man company with a great idea and possibly not a huge amount of programming experience, then PHP is a fair choice for prototyping your design and getting things off the ground. Then, when you realise it's a runaway success and all the investment starts piling on board, the last thing you want to do is stop…

"Then, when you realise it's a runaway success and all the investment starts piling on board, the last thing you want to do is stop and tread water for 6 months whilst you rewrite everything (introducing a whole new set of problems as you do), just to get back up to where you are now, before adding those new features."

Using Ruby on Rails, .NET, or python won't magically give you great programming skills. If you are a poor developer in general, you will run into problems with all of these languages.

"So, arguably these sites are successful because of their ideas, and the fact that they use PHP is more likely a historical accident than a carefully considered decision, at least in terms of their codebase."

All sites are successful because of their ideas. Using language X is just a design choice. I carefully choose php for all of my projects because it's better than all of the alternatives. I know I'm not alone in my thinking.

"To put a positive spin on it, you could argue that their early choice of PHP is what allowed them to become successful by letting them get their ideas out, rather than the best technology for a internet top-100 site or whatever."

A positive spin? How about a bias spin against php. If this were the case, we would see many more sites using other languages because PHP is so terrible.

Here is an old article on why the guy from cdbaby.com switched from ruby back to php:

http://www.oreillynet.com/ruby/blog/2007/09/7_reasons_i_swit...

Re: Stack Overflow: Defend PHP - convince me it isn't horrible

#40

Post by pilif »

mfukar wrote: post #32
pilif wrote: post #13

I'm spending most of my time maintaining a web application consisting of around 150k lines of PHP code. We (well - initially, it was just me) began development back in 2004 but since then the application has grown constantly. Back in 04, I already felt some reservations against PHP, but that's what I knew best and that's what was most used for the web (Rails might have been around, but not really known - other ruby o…

It's just as secure as any other language you can write insecure code in (i.e. all of them). That may be true; I've only developed two half-serious projects in PHP a while back. But given the amount of XSS and injection vulnerabilities we're seeing daily, I think that something is wrong with those web development guys. PHP is admittedly a widely used tool and I can't help but wonder: " Could it be just the language?…

up until very recently, no templating language provided XSS protection by default. Rails sample code you see in the various tutorial for example still is full of which for all versions of rails PHP had a filter extension that helps with this for ages, but it's not on by default and not widely used by the various projects which hope/need to still run on up to 10 years old versions of PHP.

We'll see how the common Rails user will react to all text injected into ERB being escaped by default. I'm sure this will cause rants like http://news.ycombinator.com/item?id=1162122 which was complaining that ruby 1.9's string handling became "so complicated".

"but... I just want to allow the user to type HTML and to display it - why do I have to go all these lengths to accomplish that?"

Post reply on HN