PHP 7 deployment at Dailymotion

P.S. Now I wish somebody just implements a good Async IO system and ability to run HTTP right off the PHP engine (I know there is php -S ...; I am talking about a better async system).

It wasn't mentioned in the post from Slack, but default superglobals and the earlier register_globals design decisions are the worst and most impactful wart in PHP.

Because it was designed as a templating language, the default web server interface, which is CGI - will auto-expose all variables in global scope, ex.

    echo $_POST['user_id']

Worse - and i've seen this a lot, even with Laravel, CodeIgniter, Cake, Symfony/Silex etc. you end up with these well structured projects that declare request classes, methods and variables etc. etc. but then sometime down the road a developer takes a shortcut in a method and pulls in a $_GET or $_POST inside a controller (usually because they don't know how, or aren't bothered to - changing all the related classes) - running around the default exec stack.

I've seen this so often - because it's so easy to do it. The most common place is where a designer has built a frontend AJAX form. They now need to build a quick backend check, so they Google "php backend ajax username check" and they'll likely get a result like this one:

http://stackoverflow.com/questions/29459183/check-username-a...

where the 4th and 5th lines to the solution are:

    $username=$_POST['username'];
    $query="SELECT * FROM username_list WHERE     username='$username' ";

You can spot this type of vulnerability from the frontend because the URLs used in the AJAX calls don't match the URL router patterns for the rest of the app (ex. GET /user/username_check_ajax.php vs /user/check_user).

In other languages you can't get that without using a standard library that will escape the values by default. Any solution you search for will always be a safe method to obtain the variable values by default.

Some good news: Hack doesn't expose superglobals in strict mode:

http://cookbook.hacklang.org/recipes/get-and-post/

I'd strongly recommend that this is used in all PHP projects, since it strictly enforces variable access - even in cases where you're using a framework that is supposed to enforce it.

IMO PHP missed a big opportunity with not removing superglobals in version 7 and enforcing an explicit safe request object much like other languages do. They likely wanted to avoid it because of the cluster of register_globals and magic_quotes from earlier versions.

[0] I think it is important to distinguish PHP the language and PHP the runtime. PHP the language is now decent - having caught up with a lot of features (although I find it very verbose and harder to read) while PHP the runtime is undoubtably still a horrible runtime - hence HHVM

We're currently building a pretty large production system in it. It's got a few warts, but it's damned nice, and it's compatibility with ReactPHP (event-loop, not the front-end tool!) is super useful!