Live data from Hacker News

Coding Horror: The PHP Singularity

codinghorror.com

321–330 of 341 posts

Re: Coding Horror: The PHP Singularity

#321
post #48

I seriously groaned when I saw this post (title). I was expecting an elitist diatribe about PHP (because this is perennially popular amongst particular programmers) but that's not what this post is intended to be. Interestingly Jeff does take the usual potshots at PHP almost like he thinks he'll lose street cred if he doesn't but the basic message I agree with: if you want someone to stop doing something you consider…

I can add to this list: 5. The set of functions for a gazillion useful everyday things that don't come standard in other languages. Where else would you find functions like htmlentities(), strip_tags(), mysql_real_escape_string()? I like list comprehensions - Python can be very concise - but PHP isn't exactly verbose: Compare, reading a web page: http://rosettacode.org/wiki/HTTP#PHP http://rosettacode.org/wiki/HTTP#P…

When I wrote in PHP (and it lasted 10 years just to let you know), I would say exactly the same. PHP tasted better than, say, C++ Builder.

As we use to say in my country, "never tried things sweeter than carrot". I mean that was about me: I didn't know better things existed.

All that is done better in Python:

5. You don't need many of functions you use in PHP, for instance, _real_escape_string is not needed when you can do cursor.run("SQL Query param1=? AND param2=?", [param1, param2])

6. You can get help on functions in coding shell:

>>> help(open) # help on file opening function or even >>> open? # in IPython

With that I look into online or PDF docs quite rarely.

7. That's even faster in Python: you try things out in the shell, then save the shell session (IPython) and copy the code you need into the working file.

Moreover, while in PHP I was adding var_dump's everywhere, reloading a page 10 times before reaching the source of a bug, in Python I just do $ python -m ipdb same_script.py and have the debugging shell in the place I need, and it takes a minute of two to find the source of a bug.

Re: Coding Horror: The PHP Singularity

#322
post #136

Earlier quoted context omitted.

Have you done any Agda, recently?

I for one will freely admit that my Haskell still sucks and so I presume I'm not even smart enough yet to start on Agda. Do you recommend it? Do you find it to be (one of) the highest known point on the power continuum?

Oh, I'm still stuck at Haskell, which doesn't suck but could be better. A friend of mine did some playing around with automated proof assistants, and I've been to some talks about seL4, a microkernel prototyped in Haskell, written in C, and proven correct in Isabelle.

From Haskell you can of course go the route to Agda or Isabelle. But Curry is also worth a visit, it combines logical and functional languages.

I, for one, am still learning how to do left-fold based IO in Haskell with enumerators, at the moment.

Re: Coding Horror: The PHP Singularity

#323
post #289
post #125

Earlier quoted context omitted.

Just needs a bit of type system magic. Don't use the same type for escaped and unespaced strings. (And don't use the same type for user generated input before and after it's scrubbed / escaped of any nastiness.) Ask any Haskell weeny for details. Also in your example, you'd probably be better of, if your language knew about the HTML structure, e.g. something like P($var), instead of putting the tags in as strings.

> Just needs a bit of type system magic. I like this, although when you concatenate strings, does it actually concatenate them (and loose the type info)? Does it escape them, and then concatenate? Or does concatenation actually make a closure, which is only executed upon output? (And does doing that make things memory heavy.) Haskell is on my next language to learn list. > something like P($var) Ugh. I hate that. I'v…

Yes, judging by your questions Haskell is a good language to learn for you. To give you a sneak preview: You can use the type system in such a way, that your source program will safely discriminate between the two types of strings (e.g. tainted and untainted), but there won't be anything left in the compiled assembly (tags or wrapping or whatever).

Also about the HTML: You can of course use different syntax for what I proposed, one that's closer to actual HTML. But I think as long as the syntax tree is preserved, it's still close enough to HTML for me, and all your accumulated knowledge about HTML is still applicable. (Not to be derisive, but if your years of learning are no longer of any use upon such a cosmetic change, you should probably examine your level of comprehension.)

Re: Coding Horror: The PHP Singularity

#324
post #293
post #289

Earlier quoted context omitted.

> Just needs a bit of type system magic. I like this, although when you concatenate strings, does it actually concatenate them (and loose the type info)? Does it escape them, and then concatenate? Or does concatenation actually make a closure, which is only executed upon output? (And does doing that make things memory heavy.) Haskell is on my next language to learn list. > something like P($var) Ugh. I hate that. I'v…

How about just: $foo = $textvar ; $foo->append( Hello! ); // etc. Mozilla proposed to add XML literals to JavaScript at one point, which didn't take off for security reasons, but server-side it's a different ballgame... maybe it could be worked out? Hmm.

Wow, that's even uglier. But you did not only propose an alternative syntax for HTML, but also for its manipulation. So that's a good enough excuse.

Have you looked at how Racket (Scheme, Lisp) deals with encoding HTML in S-expressions? I find that rather nice, and even prefer it to plain HTML or XML. Racket is a fine language for manipulating S-expressions, too.

Re: Coding Horror: The PHP Singularity

#325
post #125

Earlier quoted context omitted.

Just needs a bit of type system magic. Don't use the same type for escaped and unespaced strings. (And don't use the same type for user generated input before and after it's scrubbed / escaped of any nastiness.) Ask any Haskell weeny for details. Also in your example, you'd probably be better of, if your language knew about the HTML structure, e.g. something like P($var), instead of putting the tags in as strings.

I agree, the language runtime should support this somehow. http://roboprogs.com/devel/2009.07.html#2009_07_30 (point number 4 in the numbered list) Of course, I was thinking of a runtime attribute, rather than static typing, but the idea is similar.

Even with static typing, you might end up implementing using run-time support. (Of course the holy grail is to compile away all type information. But that's not only attainable. Even Haskell's ghc compiler keeps some information around for runtime. Something to do with typeclasses, if you want to look up the details.)

Re: Coding Horror: The PHP Singularity

#326
post #125

Earlier quoted context omitted.

Just needs a bit of type system magic. Don't use the same type for escaped and unespaced strings. (And don't use the same type for user generated input before and after it's scrubbed / escaped of any nastiness.) Ask any Haskell weeny for details. Also in your example, you'd probably be better of, if your language knew about the HTML structure, e.g. something like P($var), instead of putting the tags in as strings.

> Don't use the same type for escaped and unespaced strings. And if you can't extend your type system to make this work, do it in your head, mutating the names of variables to help you keep it straight. For example, esStr and unStr are not of the same type, and moving data from one to the other without conversion is always an error.

And you might even write a `lint' like source auditer to warn you about those conversions, even if your compiler doesn't.

Re: Coding Horror: The PHP Singularity

#327
post #297

Earlier quoted context omitted.

> Strict-equals on objects compares the references; but regular equals compares the contents of the objects. Two objects compare equal if the contain exactly the same fields and values. Seems pretty reasonable to me. The line you quoted is talking about ordering, not equality. > This is a good thing; JavaScript gets this wrong. It IS a good thing, but it stands out when most of the language is extremely weakly-typed…

> It IS a good thing, but it stands out when most of the language is extremely weakly-typed You only need distinct operators if your language is weakly typed. If you language is strongly typed like Python, Java, or C# then there is never any conflict between addition and concatenation. VB/VB.NET is also weakly typed and has separate operators. > So some things (objects) are passed by reference implicitly, and some (a…

tl;dr: I value consistency in my tools because it's a great measure of how frequently they'll trip me up and get in my way while reading or writing code. My biggest problem with PHP above all else, which I tried to write my article around, is that it's an inconsistent jumble from top to bottom.

You're absolutely correct, of course, in that you can write decent PHP by avoiding large chunks of the language, memorizing what things act differently from other things that look the same, not trying to do anything too dynamic, adding boilerplate to every project to fix useless default interpreter behavior, and so on. You can also waltz across a minefield if you just remember where all the mines are. But the necessity of doing all these things is exactly my argument: why bother with all this from a tool that's supposed to help you get stuff done? Because it has $_GET out of the box? You can't even claim "ease of learning" as an advantage after all this, because judging by your own responses, much of the language is pitfalls just waiting to trip up beginners who haven't yet learned the right painful lessons.

Yes, I'm not a PHP programmer. And as a not-PHP programmer, a lot of PHP looks totally crazy. But when outsiders complain about craziness in Python or Perl or Haskell or whatever, at least that craziness can usually be explained as consistent with the rest of the language, or part of an overall philosophy, or the result of some valuable tradeoff. And if not, we're very sympathetic about the ugly warts on our dearly beloved. Yet all anyone has ever been able to tell me about PHP craziness is "well, you shouldn't do that anyway" or "that's how it is in one of ten other languages" or "I have no explanation but here's a workaround so it's like the problem doesn't actually exist, right".

It is hard for me to understand how even someone who loves PHP can't see this as deeply alarming.

> You only need distinct operators if your language is weakly typed.

I don't dispute that: I claim that having separate addition and concatenation operators, but having a single set of equality/comparison operators, is inconsistent.

> Yes, like most ever other language in existence. You know, Java, C#, Python, etc.

Incorrect. Python passes everything by reference (value reference, not name reference) because everything is an object. Passing never performs a copy. I'm under the impression that Java is the same. Perl passes by alias, though the aliases are generally then copied to locals, and it has that whole array-flattening behavior which muddies things.

> Because all code should be contained within a namespace going forward. Constants should not be defined in the top-level.

Everything in Perl is in the `main` namespace unless otherwise specified. One wonders why PHP could not retrofit its new features onto the language like Perl has done for decades, rather than leaving half the language to flounder.

> No, it doesn't work that way. You have to explicitly cast. If you use an array type-hint you can only pass an array.

I'm assuming you're using the explicit cast inside the hypothetical function.

> PHP is also bytecode-interpreted. I'm not really sure what point you're trying to make.

You appeared to be citing interpreted-ness as a reason for having a wonky module system. I am naming other interpreted languages with useful module systems as counterexamples.

> The fact that is or is not a function is insignificant; you use it the same way.

Unless you want to do other function-y things to it, or any of the other pseudo-functions. The syntax is deliberately designed to make you think something is a function, but it only acts like a function in one particular way. (And as a side effect, there are a ton of simple function names you can't use as method names, because the parser gets very confused -- even though this seems like it should be unambiguous.)

> Oh, you're saying if you don't provide any of your own error handling and let it spill out the terminal -- yes, you're right -- no stack trace by default. Not that you should be doing that.

Defaults matter. This is an atrocious default.

> Turn on E_STRICT and it'll tell you.

It'll tell me what things I've already done; I can't easily find out what I should be avoiding proactively.

> Calling a string literal is pointless! 'test'() is test()!

So what? Both are values; why is there any distinction? Hell, you can call methods on numbers in Ruby and Python. I don't care about the practical value here; it's yet another place where PHP is inconsistent for seemingly no reason.

> If you've ever complained about security in PHP, you need to give that up right now. Because you just gave everyone a false sense of security.

Howso? The problem with mysql_escape_string was that it didn't take the current database handle into account. So: make it take the current database handle into account. It may not have solved everyone's problems, but the exceptions are obvious, and it would have fixed problems for far more people than the actual solution (zero).

If you're using multiple handles and passing them around explicitly, you'll have to fix your code either way.

Re: Coding Horror: The PHP Singularity

#328
post #297

Earlier quoted context omitted.

> Strict-equals on objects compares the references; but regular equals compares the contents of the objects. Two objects compare equal if the contain exactly the same fields and values. Seems pretty reasonable to me. The line you quoted is talking about ordering, not equality. > This is a good thing; JavaScript gets this wrong. It IS a good thing, but it stands out when most of the language is extremely weakly-typed…

The real point here is that you're not a PHP programmer. You're complaining about a language you don't use and trolled the web for this material without even testing much of it out yourself. And sadly your uninformed opinion is now the go-to article when talking about PHP flaws. You've won the Internet.

I drooled far more PHP into my terminal that weekend than you would believe. There were a scant few legitimate errors, and I've removed all the ones brought to my attention.

The rest of it should be factually correct, in which case, why do you care that I listed it? If you're correct in that many of the things I listed aren't really a big deal, the reader will agree with you anyway, right?

(Also, "trawled". No snark intended; it's a neat word and deserves more exposure.)

Re: Coding Horror: The PHP Singularity

#329
post #5

Sorry Jeff. The only thing broken with PHP is you (and other people like you). How much PHP do you use Jeff? Lets assume none. How is PHP hurting you? I mean seriously, how much contact do you even have with PHP? PHP is easy to learn, easy to make websites with. There are a tonne of paying jobs which require PHP. PHP runs a lot of websites. I am a PHP developer. I prefer Python but my PHP job pays me just fine. There…

"I prefer Python". Why did you say that? To me it feels like you said it do people would take you seriously as a "real" developer. Because surely a "real" developer wouldn't actually enjoy using PHP or use it unless they were forced, right? I agree with your point and I just wanted to add that the fact that we have to add in little details like "I prefer Python" just to be taken seriously says more about hacker eliti…

I get what you are saying, I didn't add this to be taken seriously. I am not bothered if I am taken seriously or not. I had an opinion which I couldn't keep to myself. Upvote / downvote / flag and ban the account. I am not massively bothered.

I do genuinely prefer Python. I picked it up when Django first started making noise and I really enjoyed working with Python (not so much Django). Now I mainly use Python to mess around with PyGame.

Its not a difficult to thing to say. For all of PHP's ease there are little niggles which get you down. Really simple things. Is a function called functionname or function_name. Is it ($needle, $haystack) or ($haystack, $needle).

Python is neater and I like neat.

Re: Coding Horror: The PHP Singularity

#330
post #27

Earlier quoted context omitted.

"You can't do: $something->doStuff()[0]" Yes you can. "Speed" Care to expand on this one?

"You can't do: $something->doStuff()[0]" Yes you can. ------------- AFAIK, yes, in PHP 5.4 only so far, which is only about 4 months old. The first 15+ years of PHP's life, no, that wasn't possible. I'm glad it's there now, but frustrated it took so long.

Did not know this!
Post reply on HN