Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP: The Right Way

phptherightway.com

Post reply on HN
Print view View original

151–160 of 233 posts

Re: PHP: The Right Way

#151

Post by mtts »

xd wrote: post #46
kellishaver wrote: post #30

Earlier quoted context omitted.

With parametrized queries, that becomes a non-issue, but I still see no point in cluttering the database with data that's just going to be filtered out at some point - might as well filter it before it goes into the DB to begin with. The exception, of course, being those rare cases when some users need to see the filtered data and others need to see the raw data, but even then, you likely won't want to allow everythi…

Parametized queries are just another way of filtering input ..

No they're not. They're a method for ensuring that what is meant to go into some field in some database actually ends up there and does not start doing things it should not be doing.

Re: PHP: The Right Way

#152

Post by jeltz »

jasonlotito wrote: post #69
unconed wrote: post #51

Earlier quoted context omitted.

This the wrong way to look at it, and yes, the PHP world always does this wrong because they're too focused on HTML. SQL injection occurs when you're not escaping data while producing output , namely, an SQL query sent to the DB. XSS attacks occur when you're not escaping data while producing HTML, but you don't need angle brackets to do it. allows for XSS injection with just a quote character. Header injection attac…

> the PHP world always does this wrong because they're too focused on HTML. No. The PHP world recommends, time and time again, using PDO and binding variables to queries. I've yet to meet an individual who does it the other way, other than people who are relying on extremely outdated tutorials (7+ years ago). Hell, even this document does. This document, unfortunately, uses the word filter in the wrong way, but the i…

I suggest removing the section about filtering entirely and making sure the section about PDO explains SQL injection briefly.

Re: PHP: The Right Way

#153

Post by ufo »

smsm42 wrote: post #142
ufo wrote: post #131

Earlier quoted context omitted.

WTF. Sometimes I wonder if I'm being unfairly prejudiced by not learning PHP myself and making my own decision about it but things like this make me change my mind.

You are completely correct - you are being unfairly prejudiced by judging PHP on explanations of people that do not understand it instead of learning it. If you learned it, you would know references work exactly like they supposed to, and do exactly what they are meant to do - just because they are not, as parent assumes, pointers, he misunderstands them and thinks they are weird. Moreover, he thinks since PHP in not…

I think the whole point here is why does PHP even have references like that. Right now the only mainstream language I know that does that is C++ and well, its C++ and mutable references are actually not frequently used in practice. Most other languages stay with pass by value most of the time and PHP references kind of look like a leaky abstraction from the underlying C implementation...

Re: PHP: The Right Way

#154

Post by nichodges »

nikic wrote: post #27

I like the general idea of this, but think that it is nearly useless in its current form. It's way too superficial. To teach newbies how to do things right it doesn't suffice to link to a few resources and hope that they'll read them (hint: they won't). Instead one needs more concrete code examples, etc. Which would obviously be too much for one page :)

As someone who taught themselves enough PHP to get by over the last 7-8 years, this is brilliant. I don't spend every day keeping up with the latest developments in PHP, but I know in that time the techniques I'm using must be out of date.

I've learnt JQuery and Python lately, but my Swiss army knife is still PHP. So this has already fixed a lot of incorrect techniques I've been suing in a side project.

Re: PHP: The Right Way

#155

Post by chipotle_coyote »

aggronn wrote: post #112
Getahobby wrote: post #97

Earlier quoted context omitted.

I think it is because we (as a community) should be past the piling-on stage and on to the constructive discussion stage. Snark doesn't add to the discussion.

I don't intend to jump into the ring, but as an observer, I don't think we're at that point yet. Here's the progression of the current anti-PHP flare up: Jeff Atwood says PHP sucks |- Says we should make other languages fill in on what PHP does best |- Post goes on HN |- PHP apologists say "No! PHP is fine, I've made a career out of it!" |- 'Atwoodians' continue to reject PHP, ruby/python need to be more accessible |…

While I can't speak for others in the "Atwoodian camp," I for one think Atwood's article was that response, to a large degree: it pretty much said that his next big project is trying to bring those strengths to a platform built on another language.

Having said that, it seems to me that there's certainly a fair amount of work being done to make deploying apps in other languages pretty simple. With mod_passenger, for instance, setting up a Rails app under Apache isn't notably more difficult than setting up any other Apache virtual host. Deploying Python web applications isn't quite as simple yet (at least in my experience), but it's nothing that should be beyond the ken of someone who's figured out how to write a Python web application in the first place. And that, in turn, isn't really beyond the ken of anyone who's learned how to write reasonably good PHP MVC code.

Re: PHP: The Right Way

#156

Post by kaolinite »

kaffeinecoma wrote: post #58
kaolinite wrote: post #53

Really hope they fix the formatting. Unreadable for me, the font is way too big.

user: kaolinite 20 year old Python/PHP/C developer That font will be just perfect for you in about 15-20 years.

In 15-20 years, I will zoom as required. The issue really is less the font size and more the way the text stretches to the window, so if you zoom out then the sentences become far too long. I ended up having to alter my browser window size.

Edit: Just checked, definitely just the stretching, though a bit smaller would be better for me.

Re: PHP: The Right Way

#157

Post by mcantor »

dsl wrote: post #137
mcantor wrote: post #130

Earlier quoted context omitted.

Yeah... only idiots "sudo aptitude install" without reading and building from source first!

You really can't tell the difference between blindly executing input from an insecure HTTP connection, and installing packages with a tool that verifies cryptographic signatures against known good keys shipped with your distro? Mr. Cantor, I have added to the list of people to never hire I keep in my notebook.

So? Who says the verified package isn't malicious? My point isn't about cryptography, it's about complexity. Unless you personally read through every line of code, how do you really know that there isn't something in there waiting to screw you over?

Re: PHP: The Right Way

#158

Post by batista »

dsl wrote: post #137
mcantor wrote: post #130

Earlier quoted context omitted.

Yeah... only idiots "sudo aptitude install" without reading and building from source first!

You really can't tell the difference between blindly executing input from an insecure HTTP connection, and installing packages with a tool that verifies cryptographic signatures against known good keys shipped with your distro? Mr. Cantor, I have added to the list of people to never hire I keep in my notebook.

And I've added you to the list of guys that think they are "the shit" because they have hiring abillities (in some shitty company) and need to tell it on the intertubes.

Re: PHP: The Right Way

#159

Post by batista »

dlitz wrote: post #126
simonbrown wrote: post #106

Earlier quoted context omitted.

They do. http://www.joelonsoftware.com/items/2006/08/01.html http://skilldrick.co.uk/2010/09/why-javascript-is-awesome/

Javascript is just Scheme with a C-like syntax and a limited number of bad design decisions (like automatic semicolon insertion and the == operator). PHP is a never-ending fountain of bad design decisions, because its core devs continue to make new ones.

really? add: floating point everywhere, objects that act like hashes but not exactly, fucked up scoping rules including global by default, the braindead Dom API, a severiously limited standard library, and brain damage coersions to the list...

Re: PHP: The Right Way

#160

Post by batista »

lukifer wrote: post #114
chrismsnz wrote: post #85

Earlier quoted context omitted.

Exactly, this is what infuriates me about the arguments and whining against PSR-2. Spaces, Tabs, OTBS, whatever. It doesn't matter which one was chosen, just that something was chosen. Ask the Pythonista's what PEP8 did for their developer's ecosystem. Also it's important to note that that PSR-2 was based off already existing coding standards like Zend's and Symfony's.

And what do you do with all the coders like me who would refuse to change their habits? Does the Python community have tabs holdouts who are github lepers because no one wants their code "infected"? (I don't do much in Python, I actually don't know what the community norms are.) I think it's silly to pursue per-language consistency; it's a pipe-dream that just leads to more religious wars over minutia. Per-project (o…

>And what do you do with all the coders like me who would refuse to change their habits?

Reformat their code.

As for "per language consistency", Go does it just fine...

Post reply on HN