Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP: A fractal of bad design

me.veekun.com

Post reply on HN
Print view View original

241–250 of 514 posts

Re: PHP: A fractal of bad design

#241

Post by Sapient »

kamaal wrote: post #215
Sapient wrote: post #194

Earlier quoted context omitted.

This is no excuse. If you want to learn how to do something, effort is required. How much time will that person waste in the long run battling all of the problems and traps PHP brings with it? I contend that learning a proper language will be of greater benefit to a person just starting web-development, and putting in just a few extra hours at the beginning to get a solid foundation will in fact save them time in the…

I agree, but lets say your car breaks down somewhere in the middle of the road. Now you have two options. One is to learn the entirety of automobile engineering before touching your car, second is to learn enough fix the problem for the moment. Needless to say any normal person will prefer the second approach. Now some mechanical engineer may make an argument that this small quick fixes are harmful for long term mech…

The effort required to learn something better than PHP is not equivalent to learning everything about automobile engineering, its more like reading a maintenance manual. Sooner or later, the guy who fixes his car in the middle of the road without knowing anything is going to replace his brake-pads with bits of wood he found on the sidewalk (Not really his fault, someone on a PHP forum has already labeled all the bits of wood as "brake pads")...

Re: PHP: A fractal of bad design

#242

Post by corford »

daeken wrote: post #137
patio11 wrote: post #134

Earlier quoted context omitted.

Most applications developed by professionals in Big Freaking Enterprise Languages working in regulated industries will also have game over security vulnerabilities. Most applications developed by the cool kids in Ruby/Python working for startups will have game over security vulnerabilities. The current state of information security: basically, we're screwed.

Agreed. While PHP apps are definitely more likely than others to be vulnerable to systemic SQL injection, XSS, and other vuln classes of that sort, all applications are equally vulnerable to things like command injection, authorization bugs, etc. No one gets that stuff right, and if you can execute code on the system, well, it doesn't really matter if you can't find SQLi.

Why is PHP more likely than others to be vulnerable to SQL injection attacks? Most people (and likely All newbies) will be using PDO which automatically protects them.

Re: PHP: A fractal of bad design

#243

Post by tmh88j »

TazeTSchnitzel wrote: post #212
philjohn wrote: post #186

Earlier quoted context omitted.

Why do you care so much about what other people use to get a job done? Care about what you use.

Because it's not good for the web if more newbies are using such a woefully insecure language.

Why is it not good for the web? Unless an insecure website is leaking personal information, I don't see how that affects you. Besides, how many websites designed by newbies reach hundreds of thousands of daily visitors (or even tens of thousands for that matter)? If said website is so terribly designed, no one would visit it because it would load slowly and be ridden with bugs; no fun.

Re: PHP: A fractal of bad design

#244

Post by Sapient »

tangue wrote: post #225
Sapient wrote: post #194

Earlier quoted context omitted.

This is no excuse. If you want to learn how to do something, effort is required. How much time will that person waste in the long run battling all of the problems and traps PHP brings with it? I contend that learning a proper language will be of greater benefit to a person just starting web-development, and putting in just a few extra hours at the beginning to get a solid foundation will in fact save them time in the…

>This is no excuse. If you want to learn how to do something, effort is required. Some people doesn't want to learn web programming. They want to get things done. Think of PHP as an equivalent of Bootstrap on the server side. People don't use Bootstrap because it's beautiful but because they can't design and in fact don't need anything fancier.

The difference between getting it done NOW and getting it done properly is very small in terms of time and huge in terms of safety.

There really needs to be a "good" version of PHP.

Re: PHP: A fractal of bad design

#245

Post by corford »

FuzzyDunlop wrote: post #219
shuzchen wrote: post #104

Earlier quoted context omitted.

I find it odd how many people keep saying it's that simple to push PHP code to a box and get it working. Sure, if you've got crazy simple requirements it's generally a cinch. Once you do anything remotely non-trivial (want to read from a file? use some third party library, handle errors in a consistent manner) then you start hitting into issues with file permissions, PHP version differences, modules not compiled in b…

I can attest to PHP deployment being an absolute nightmare. Of course, the difference is that we're not beginners here; far from it, really. While the beginner will love being able to open up an FTP client (probably one that's a browser extension) to upload a few files they've changed, that's not going to fly for us. We want proper deployment, source control, and for it to be used properly. We don't want to go anywhe…

I don't understand how deployment, source control and not patching your live code have anything to do with PHP.

Keep your source in a svn or git repo, export the new release branch or bug fix release to a testing box and once you're happy move it over to production. What does any of that have to do with PHP itself?

If you're talking about moving from one version of PHP to another, just compile the new version of php in a different directory from the old version (e.g. /var/lib/php/5.4 ), create a new virtual server definition in apache and point it to the newly compiled php version (e.g. using Apache's mod_fcgid) and test your site. Once you're happy, make that virtual server live to the public and retire the older one.

Re: PHP: A fractal of bad design

#246

Post by yahelc »

sylvinus wrote: post #184
greggman wrote: post #175

Earlier quoted context omitted.

I agree with you and I'm really surprised in 15 years, or how over old PHP is, THERE IS NOT ONE SINGLE ALTERNATIVE!! Why? For PHP I sign up for one of the million LAMP ISPs, I upload a .php file with .php embedded in HTML and I'm done. Where's the Ruby version of this? The Python version? The JavaScript version? The Perl version? THEY DON'T EXIST. You wanna use Perl or Python. You either have to use slow slow cgi or…

> Where's the Ruby version of this? The Python version? The JavaScript version? heroku ? you don't even have to upload anything manually, a single command deploys your app.

That's not the same level of beginner friendly.

With PHP, you have a file with a .php file suffix on your server.

That file has code in it. Navigate to that file on your browser. You have a dynamic website.

No installation of external programs is necessary. No terminal. Often, you don't even need an FTP client, since you can use your hosting provider's GUI.

That blinding level of simplicity gets the non-programmer started in under an hour.

To run Heroku (on a Mac), you need to download (1.8GB) and install XCode (or another version of GCC for Mac, but the moment you say GCC, the beginner's eyes glaze over). Once you install XCode, you need to open up terminal (no GUI). Then you install homebrew in order to install the dependencies that Heroku tools require (some JSON libs, if I recall). Once that's installed, you need to install the heroku cli tools. Now you can deploy your heroku app, which requires registering (or, in the case of beginners, generating) ssh keys.

Every single one of those steps is too difficult for the beginner. That is why PHP wins.

Re: PHP: A fractal of bad design

#247

Post by eurohacker »

landr0id wrote: post #72
felipellrocha wrote: post #46

Earlier quoted context omitted.

The day you learn Python and see the light, you will look back and wonder, "Oh, God. Why?"

I actually have to agree. I started out my programming experience with C# -> PowerPC (strangely) -> C++ -> touched upon PHP -> Java -> Python -> Objective-C. Out of all of these languages, Python was by far the easiest and most flexible language to learn. I've never done any sort of web development at all (no HTML, CSS, JavaScript, etc.), but I set up a local Django server to do stuff with, and I absolutely love it.…

Out of all of these languages, Python was by far the easiest and most flexible language to learn..

are you saying that Python is easier to learn than PHP

Re: PHP: A fractal of bad design

#248

Post by eurohacker »

dasil003 wrote: post #165
sandwitch wrote: post #82

is there a major new startup that has been built with php in the last couple of years ? can you name one ? http://www.reddit.com/r/PHP/comments/rh3u2/any_new_major_sta...

As pointed out in the comments there, 2 years is not really a big enough window to identify a "major" startup.

Instagram is younger than 2 years, isnt it

Re: PHP: A fractal of bad design

#249

Post by ForrestN »

drivebyacct2 wrote: post #93

I regularly, (all over this thread), see people swear that PHP is great for beginners. Everything in this article seems to indicate the opposite. You have to trip over PHP's poor design while trying to learn to program. Outside of the wide availability of PHP servers for cheap, what makes PHP so great for beginners? With Ruby, Python, Go, hell, even JSP for the "instant", in-HTML effect, I just don't see PHP as some…

I've been coding PHP for years and am just starting to learn Ruby on Rails. I'm not a programming expert at all, and so most of the objections mentioned would take me a while to parse.

From my perspective, Ruby on Rails is really, really difficult so far. You have to learn to use the terminal (which I've seen other people in my position use to totally mess up their computers); to make a simple application you're already looking at maybe a dozen files, many of which you don't understand; most importantly for me, because there is a lot of stuff going on that you can't see, it's very hard to extrapolate from examples.

I have learned what programming I know from breaking apart example programs and then using the pieces to build other things. I'm not good at learning from textbooks or tutorials. This has proved very difficult with RoR so far. I'll take components that look like they should make something happen, and then they'll throw an error that I don't understand and can't seem to locate.

Re: PHP: A fractal of bad design

#250

Post by alttag »

corford wrote: post #242
daeken wrote: post #137

Earlier quoted context omitted.

Agreed. While PHP apps are definitely more likely than others to be vulnerable to systemic SQL injection, XSS, and other vuln classes of that sort, all applications are equally vulnerable to things like command injection, authorization bugs, etc. No one gets that stuff right, and if you can execute code on the system, well, it doesn't really matter if you can't find SQLi.

Why is PHP more likely than others to be vulnerable to SQL injection attacks? Most people (and likely All newbies) will be using PDO which automatically protects them.

It's only a protection if properly used. Bound parameters don't work well for some types of dynamic queries.
Post reply on HN