Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coding Horror: The PHP Singularity

codinghorror.com

Post reply on HN
Print view View original

111–120 of 341 posts

Re: Coding Horror: The PHP Singularity

#111

Post by ars »

skrebbel wrote: post #82
ars wrote: post #65

Earlier quoted context omitted.

> default to HTML escaping on output ??? Is that a joke? Don't do that! That's just as bad as magic quotes. > no register globals It hasn't existed for a quite a while now in PHP. Other than that I quite agree with what you wrote. Most of the criticism of PHP is simply a desire to be special. If lots of people are using something, you want to make sure not to, so that you feel special. Now that you've decided not to…

> > default to HTML escaping on output > ??? Is that a joke? Don't do that! That's just as bad as magic quotes. No, it's not. Magic quotes are a pain to reverse. HTML escaping can be built into the echo/print/ commands, so that it is: - A setting that can be totally turned off at run-time, if you want; - Easily overridden on a case-by-case basis with a 'rawecho' function that does *not* escape anything.

I've seen too many multiply encoded things to be so sure this is a good idea.

Plus too many cases of extra backslashes from back in the magic quotes days.

Re: Coding Horror: The PHP Singularity

#112

Post by kaffeinecoma »

Everyone's jumping on the PHP bashing. I don't think that's what this blog post was really about. Did you read to the end?

  One of the explicit goals of my next project is to do whatever we can to 
  buff up a ... particular ... open source language ecosystem such that it can
  truly compete with PHP in ease of installation and deployment.
Kind of a cliffhanger ending... What are you building, Jeff?

Re: Coding Horror: The PHP Singularity

#114

Post by ars »

gecko wrote: post #85
ars wrote: post #65

Earlier quoted context omitted.

> default to HTML escaping on output ??? Is that a joke? Don't do that! That's just as bad as magic quotes. > no register globals It hasn't existed for a quite a while now in PHP. Other than that I quite agree with what you wrote. Most of the criticism of PHP is simply a desire to be special. If lots of people are using something, you want to make sure not to, so that you feel special. Now that you've decided not to…

> > default to HTML escaping on output > ??? Is that a joke? Don't do that! That's just as bad as magic quotes. Microsoft's Razor and Python's Django templates have both shown that HTML-escaping-by-default can be cleanly done in a way that is not magical and that is highly reliable. I'm not honestly sure what you're protesting here.

If I make a string: '

' . $var . '

' - does it know to encode the variable, and not the entire string?

What if I assign that string in a variable, and then output it later?

I'm not convinced this can be done well. Maybe if all you do is make some templates and fill them in you could do it. But I do a lot more than that, I output dynamically built html all the time.

Just give people a very easy and shortly named function for escaping.

Re: Coding Horror: The PHP Singularity

#115

Post by dguaraglia »

tocomment wrote: post #68

a few years ago a graphic designer asked me for some help using PHP to query a database. I wrote a little thing that worked, and then said, "oh wait, this could be a problem with SQL injection, here's how you fix that". And his response was "umm can you just send me the first thing you wrote".

I completely agree with you. The problem with PHP (besides the myriad warts of the language and libraries) is the average kind of programmers that use it: 0 code reuse, lots of cut & paste, insecure-by-design philosophy and the culture of 'immediate results': if there's an error fix it fix it for the current page so that the next time you refresh it'll be gone; then fix it on the other pages later. Rinse, repeat.

Re: Coding Horror: The PHP Singularity

#116

Post by agscala »

acoyfellow wrote: post #108
chez17 wrote: post #73

Ok, so here it goes. I haven't commented on this site for over a year. Full disclosure: I am an average programmer compared to many here. I come to this site to improve my self and read about what brilliant and amazing things you all do. Now you have a reference. I use PHP on a daily basis, have been for years. I am a freelance developer who has been able to carve out a living with a lot of hard work and a lot of luc…

"Finally, let's use his tool analogy. PHP is a double-clawed hammer. What if your job was to remove nails from wood all day?" Brilliant.

Not brilliant. You can use a regular hammer just fine to pull nails out of wood all day AND to nail the occasional one in should the need arise.

Re: Coding Horror: The PHP Singularity

#117

Post by Isofarro »

leothekim wrote: post #25

PHP got Facebook up and running, so it has that to its credit. And that's a huge credit. As a result, Facebook engineers developed things like this: http://en.wikipedia.org/wiki/HipHop_for_PHP Which is an impressive piece of technology, but makes you wonder if Facebook engineers wish their website wasn't written in PHP.

It surprised me, considering the original developers of facebook (Zuckerberg, Moskovitz) were doing Computer Science degrees why they chose PHP to build it in initially. Did they consider other languages, or frameworks.

I'd be surprised if they chose PHP because of future hireability / scaling up. I'd guess they didn't give it much thought and PHP was just there.

Re: Coding Horror: The PHP Singularity

#118

Post by adgar »

gecko wrote: post #85
ars wrote: post #65

Earlier quoted context omitted.

> default to HTML escaping on output ??? Is that a joke? Don't do that! That's just as bad as magic quotes. > no register globals It hasn't existed for a quite a while now in PHP. Other than that I quite agree with what you wrote. Most of the criticism of PHP is simply a desire to be special. If lots of people are using something, you want to make sure not to, so that you feel special. Now that you've decided not to…

> > default to HTML escaping on output > ??? Is that a joke? Don't do that! That's just as bad as magic quotes. Microsoft's Razor and Python's Django templates have both shown that HTML-escaping-by-default can be cleanly done in a way that is not magical and that is highly reliable. I'm not honestly sure what you're protesting here.

GWT too. Not having escaping by default by now, in 2012, is just plain backward.

Re: Coding Horror: The PHP Singularity

#119

Post by gizzlon »

polyfractal wrote: post #74
cageface wrote: post #54

Earlier quoted context omitted.

Basically, Jeff just agreed that PHP is simply better than the rest. Easier != better. Nice try.

Debatable. What's your end goal? If your primary goal is making money (through the web) and you are non-technical, easier does in fact equal better. The GP's brother isn't going to stop what he's doing and learn Ruby so he can rewrite his whole website in gloriously succinct and elegant code. He's going to tweak his site, continue making money and stop caring about whatever the hell his site is written in.

I get your point, and it's important to get s¤% done. But you have to at least consider that what's easy right now might not be the easiest in the long run.

Maybe a little OT, but I can't shake the feeling that he's going to introduce some nasty security bugs if he's hacking on php code without knowing what he's doing. Might not matter, but then again someone could find it and completely ruin his small business.

(of course you can write "secure" code in php, but you need some knowledge to do so..)

Re: Coding Horror: The PHP Singularity

#120

Post by RobAley »

scribu wrote: post #6
bobsy wrote: post #5

Sorry Jeff. The only thing broken with PHP is you (and other people like you). How much PHP do you use Jeff? Lets assume none. How is PHP hurting you? I mean seriously, how much contact do you even have with PHP? PHP is easy to learn, easy to make websites with. There are a tonne of paying jobs which require PHP. PHP runs a lot of websites. I am a PHP developer. I prefer Python but my PHP job pays me just fine. There…

Hey, at least he's not just ranting like everyone else; he's trying to bring forward a better alternative. I'm also a PHP dev and I think Python is the safest bet, since it has good support on all platforms already (including Windows).

He started with a highly contentious premise that he declared as fact.

Many, like me, disagree with that premise, and so consider that he is at best trying to fix a problem that either doesn't exist or doesn't require a drastic fix like he proposes, or at worst is very cleverly tapping into a vein of contention to hype an up-coming product.

The thing is, with those who do genuinely rant against PHP, at least we can have a useful debate with them over the issues. The "PHP is rubbish" posts that feature here regularly almost always lay out their arguments and basis for coming to that conclusion, from which useful (if sometimes repetitive!) discussion can ensue.

I think that the better alternatives, in the general case, are to participate in (or even fork) PHP and bring about the change together.

Post reply on HN