Live data from Hacker News

PHP: A fractal of bad design

me.veekun.com

131–140 of 514 posts

Re: PHP: A fractal of bad design

#131
post #19

"(And strictly speaking, Facebook isn’t written in PHP; it’s written in a C++ macro language with a striking resemblance.)" I'm a Facebook engineer who works on the HipHop compiler and HipHop virtual machine. It's in PHP, absolutely full stop. It's amazing how much the fact that g++ is involved somewhere in the toolchain confuses people in this matter. C++ is just an intermediate representation; the source language r…

Do your engineers use the PHP interpreter in development (for rapid prototyping) and HipHop-compiled PHP in production (for speed)?

Re: PHP: A fractal of bad design

#132
post #117

Earlier quoted context omitted.

Please enlighten me! I'm interested in correctness. The "non-programmers" remark refers to a quote from the PHP 2.0 documentation. I tried to minimize the editorializing.

Nearly every other item is wrong; I didn't bother listed them all because it would just take too long. I'm actually still reading the article since I posted that comment and I'm still finding errors.

You would do us all (author included) a favor by pointing them out. Why would you take the time to complain about the articles veracity without providing a single correction?

Re: PHP: A fractal of bad design

#133
Like many, I've grown up with PHP, and grown to dislike it big time over the years. However, it has its virtues. Now, my rule is: use PHP iff it feels like the entire script could comfortably fit inside one small PHP file. The moment my very first design feels like it's better to, say, separate the view from the controller, use a real language. Sometimes this estimation is wrong, and I end up rolling my yet-another-PHP-microframework over again, but usually this is a pretty decent rule of thumb. I don't want to have to go through setting up a VPS and a rails environment for something that'd take me the same time to coe and deploy in PHP.

Really, PHP is excellent for what it was originally designed for: little server-side scripts that do relatively simple things. I know that its authors would currently like it to be used for more than that, but, well, don't.

As long as you're not making a massive application, PHP's massively filled global scope, decent batteries-included approach, documentation-with-examples, and its support on virtually every web host (and then some) make it an excellent choice.

Therefore, I disagree with the author's notion that it's bad for everything. It's excellent for little scripts, which is was mr Lerdorf originally intended it to be for anyway.

Re: PHP: A fractal of bad design

#134
post #61
post #42

I'm going to be unfair and quote just two words from the article: > empowered amateur PHP is a gateway drug to web development. And that's awesome. With almost every other popular web development language I've heard of[1], there's this grey area between "my app works on my local machine" and "my app works on the server" that is really hard to grok as a beginner. There's a reason entire businesses are built on the ide…

It's not awesome if the applications so developed by amateurs grows to store PII, financial information or do anything that has any security consequences whatsoever since it is likely to be riddled with "game over" security vulnerabilities. Unsurprisingly, most PHP applications end up in this state. Cf. http://web.nvd.nist.gov/view/vuln/search-results?query=phpbb... - and phpbb is one of the popular ones with an acti…

Most applications developed by professionals in Big Freaking Enterprise Languages working in regulated industries will also have game over security vulnerabilities. Most applications developed by the cool kids in Ruby/Python working for startups will have game over security vulnerabilities.

The current state of information security: basically, we're screwed.

Re: PHP: A fractal of bad design

#135
post #117

Earlier quoted context omitted.

Please enlighten me! I'm interested in correctness. The "non-programmers" remark refers to a quote from the PHP 2.0 documentation. I tried to minimize the editorializing.

Nearly every other item is wrong; I didn't bother listed them all because it would just take too long. I'm actually still reading the article since I posted that comment and I'm still finding errors.

Give us the first three, big, ideally testable ones.

Re: PHP: A fractal of bad design

#136

I can't believe this article is on the top of this site. At least 50% of what's written in there is totally wrong/false. Other information is terribly out of date. And even more information is merely half-truths and lack of understanding of the language. Even pure supposition like "PHP was originally designed explicitly for non-programmers" is incorrect. This article is garbage -- don't be taken by it. I'm not going…

Having used php and run across many if not all of the issues the article lists personally I can pretty confidently say it's as close 1o 100% correct as anything I've read on the subject.

Re: PHP: A fractal of bad design

#137
post #61

Earlier quoted context omitted.

It's not awesome if the applications so developed by amateurs grows to store PII, financial information or do anything that has any security consequences whatsoever since it is likely to be riddled with "game over" security vulnerabilities. Unsurprisingly, most PHP applications end up in this state. Cf. http://web.nvd.nist.gov/view/vuln/search-results?query=phpbb... - and phpbb is one of the popular ones with an acti…

Most applications developed by professionals in Big Freaking Enterprise Languages working in regulated industries will also have game over security vulnerabilities. Most applications developed by the cool kids in Ruby/Python working for startups will have game over security vulnerabilities. The current state of information security: basically, we're screwed.

Agreed. While PHP apps are definitely more likely than others to be vulnerable to systemic SQL injection, XSS, and other vuln classes of that sort, all applications are equally vulnerable to things like command injection, authorization bugs, etc. No one gets that stuff right, and if you can execute code on the system, well, it doesn't really matter if you can't find SQLi.

Re: PHP: A fractal of bad design

#138

Like many, I've grown up with PHP, and grown to dislike it big time over the years. However, it has its virtues. Now, my rule is: use PHP iff it feels like the entire script could comfortably fit inside one small PHP file. The moment my very first design feels like it's better to, say, separate the view from the controller, use a real language. Sometimes this estimation is wrong, and I end up rolling my yet-another-P…

I used to concede that PHP is appropriate for little scripts, but I changed my mind over time, because so few of those scripts stay "little". Where is the line drawn? Do we find we need a new feature one day, decide that's enough to tip the scale, and set out to rewrite the thing—wasting all the time purportedly saved by writing it in PHP in the first place? We're lazy, so probably not.

I tried writing a little one-off Python thing in Flask last year and was actually surprised by how little effort it took. I spent more time learning Flask (and Flask is really, really simple) than I did actually deploying the thing to a VPS with spare cycles. It could stand to be slightly more turnkey, but running a tiny app server isn't nearly the nightmare it's made out to be.

Re: PHP: A fractal of bad design

#139
post #42

I'm going to be unfair and quote just two words from the article: > empowered amateur PHP is a gateway drug to web development. And that's awesome. With almost every other popular web development language I've heard of[1], there's this grey area between "my app works on my local machine" and "my app works on the server" that is really hard to grok as a beginner. There's a reason entire businesses are built on the ide…

I find it odd how many people keep saying it's that simple to push PHP code to a box and get it working. Sure, if you've got crazy simple requirements it's generally a cinch. Once you do anything remotely non-trivial (want to read from a file? use some third party library, handle errors in a consistent manner) then you start hitting into issues with file permissions, PHP version differences, modules not compiled in b…

Sure, if you've got crazy simple requirements it's generally a cinch. Once you do anything remotely non-trivial (want to read from a file? use some third party library, handle errors in a consistent manner) then you start hitting into issues with file permissions, PHP version differences, modules not compiled in by default, etc etc.

Although PHP suffers from this, I'm not sure it is alone. I suffer a lot of pain setting up Ruby environments (I don't think I've ever managed it the same way twice) and getting everything to play nice. Even Python, a language I am about as familiar with as PHP, has it's annoyances on this front.

I suspect the difference is familiarity; I can deploy a working PHP environment in my sleep, because I've done it so many times.

The other day I had to set up Java/Tomcat - literally the worst experience of my life...

Also, PHP is not helpful in local development. I think there's a built-in runserver in the newest versions, but for all of history, to develop PHP you had to install (and set up) apache and all your required modules locally.

You're thinking like a seasoned pro :) For a newbie there is xampp - a familiar looking windows installer configures the Apache/PHP/MySQL (and others) stack, then it disappears into the backround and, largely, can be forgotten.

This is huge for a new developer.

Think about it this way; if you had a class called "Learn to Write Websites", for absolute beginners, I argue PHP is a good initial choice. Because you don't have to worry about the environment, how to server it, command line, package management - which, say, Ruby would require. You just chuck in a brief overview of how servers work in general, and then get them working on some PHP scripts, with instant results.

I love this!

I like Ruby, of course - it's powerful, has modern standards, and Rails is brilliant. But for a beginner, and even moderate, developer it is a bit of a pain to work with.

With python and Django, I use virtualenv+pip to get a consistent environment, manage.py runserver to test locally. I can pretty much start developing everywhere (my desktop, my VPS, my laptop, that same laptop after I reformat it and install some new distro to test) with 3 commands.

This sort of thing (http://pypi.python.org/pypi/virtualenv) is non-trivial for a beginner.

I'm not trying to defend PHP too much here; I like it, but it is a horrible language on many levels (as are other languages).

It also just works, especially for beginners.

Re: PHP: A fractal of bad design

#140
Didn't we all go through this?

    1. Ooo, PHP is awesome, I can make stuff happen on a server!
    2. Hm, well, PHP has its problems, let's open source a microframework to fix it!
    3. Oh my god, PHP is horrible, let's rant about it on a blog!
    4. Who cares that PHP is horrible? It's the application that counts.
OP is at step 3, currently.
Post reply on HN