Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recki-CT – A compiler for PHP, written in PHP

github.com

Post reply on HN
Print view View original

11–15 of 15 posts

Re: Recki-CT – A compiler for PHP, written in PHP

#11

Post by goykasi »

krapp wrote: post #5
steakejjs wrote: post #2

This looks awesome. PHP doesn't get a lot of love but it is really improving a lot and obviously still dominates the web... Glad the turkish bug is finally done with. Would be really nice to see security augmentations to the language. The vast majority (maybe 9/10) sites I look at where no framework was used, the site is missing have no CSRF tokens, very poor XSS protections, and RCEs are pretty common too. I think t…

I find it odd that a language whose entire purpose is mixing code in with html doesn't come with the ability to automatically escape any echoed string by default. If you're not using something like Twig you have to wrap each variable in htmlspecialchars or something. The argument that 'PHP is a framework' may be valid, but as a framework, raw PHP kind of sucks.

PHP is simply a scripting language. It has numerous other uses besides just "mixing code in with html"; it wouldn't make sense to have something like enabled by default. For example, all console scripts would need to disable it.

Re: Recki-CT – A compiler for PHP, written in PHP

#12

Post by maxerickson »

devNoise wrote: post #9

Does anyone have an idea for some of Recki-CT's use cases? I get that compiled PHP will be faster. This seems useful for PHP scripts you would run from the command line. Using the resulting binary as a CGI with Apache would incur the fork/exec cost that the PHP module avoided.

Some explanation here:

http://blog.ircmaxell.com/2014/08/introducing-recki-ct.html

(it's vaguely redundant with the readme, but there is some additional stuff)

Re: Recki-CT – A compiler for PHP, written in PHP

#14

Post by krapp »

goykasi wrote: post #11
krapp wrote: post #5

Earlier quoted context omitted.

I find it odd that a language whose entire purpose is mixing code in with html doesn't come with the ability to automatically escape any echoed string by default. If you're not using something like Twig you have to wrap each variable in htmlspecialchars or something. The argument that 'PHP is a framework' may be valid, but as a framework, raw PHP kind of sucks.

PHP is simply a scripting language. It has numerous other uses besides just "mixing code in with html"; it wouldn't make sense to have something like enabled by default. For example, all console scripts would need to disable it.

Yes, it's a general purpose language and can be used for many different things, but as its name once indicated, PHP's primary use case is preprocessing hypertext. I think it would make sense since that's what almost all the PHP in the wild is involved with. Although i'm sure escaping could also be disabled by default when running from the command line.

Re: Recki-CT – A compiler for PHP, written in PHP

#15

Post by meowface »

jtreminio wrote: post #8
meowface wrote: post #7

Earlier quoted context omitted.

>PHP is not any more insecure than other languages. This is debatable. It's not if you know to avoid many awful components of the language that are pushed in tutorials (like extract, or mysql_query, or register_globals, or loose comparisons).

register_globals was removed several years ago; mysql_* functions all have a big red warning at the top of the docs pages warning users not to use it; extract has a big red warning about using it on untrusted data. PHP shouldn't hold developer's hands, but it does enough to warn them away from the Here There Be Dragons.

You're right about register_globals.

However, the others require users to actually read the documentation, which unfortunately many do not. A new user of PHP reading a tutorial does not necessarily know these functions are unsafe. They type the functions into their program and they still work, even on the latest versions of PHP. They don't see a visible deprecation warning on the page.

Post reply on HN