PHP: The Right Way • Hacker News Board

Re: PHP: The Right Way

#121

Post by jasonlotito » Sun, Jul 08, 2012, 3:55 AM UTC

gbog wrote: post #101

billpatrianakos wrote: post #90

Earlier quoted context omitted.

We get it, man. PHP sucks, you're cool/smarter/better because you use something else, and you need to remind us all about it by jumping in every time the letters P-H-P are seen in sequence to let us all know how it sucks by retreading the same old lines used by the last fifty guys who said the same thing but to your credit you really tried to be clever about it. A good portion of why people like to mock PHP is due to…

I used PHP for five years professionally, I consider myself as well positioned as many to have an informed opinion about PHP weaknesses and strengths. My diagnostic is that PHP weaknesses are structural, and no amount of guidance can fix that. If facing the choice, one should not choose PHP over other solutions. (It happens also that I am working in Chinese tech sphere, where many startup choose PHP just because it i…

> I used PHP for five years professionally, I consider myself as well positioned as many to have an informed opinion about PHP weaknesses and strengths.

Yeah, that doesn't mean anything. In fact, to be frank, when I read that, I fill in the underlying context:

"I used PHP for fives years professionally, and the code was horrible. Granted, it was code I wrote because PHP let me write code that way..."

or

"I used PHP for fives years professionally, almost a decade ago..."

> I remember we had even built a code checker that was forbiding the use of many php functions and syntax, and had a set of wrappers around basic functionalities like string functions or date functions.

Yeah, that didn't do much to change my mind.

Re: PHP: The Right Way

#122

Post by anthonyb » Sun, Jul 08, 2012, 3:55 AM UTC

eli wrote: post #117

simonbrown wrote: post #108

Earlier quoted context omitted.

Someone trying to find an exploit is a bigger problem than giving them one?

Oh, definitely. If someone has a launched a targeted attack against you and they already have the ability to seamlessly view and modify your internet traffic, you are in pretty serious trouble whether you download your development tools from wget or apt-get.

Except that apt-get will check GPG signatures and detect that kind of attack. How is a MITM attack going to find a 3rd party's private key?

Re: PHP: The Right Way

#123

Post by jasonlotito » Sun, Jul 08, 2012, 3:59 AM UTC

sopooneo wrote: post #83

jasonlotito wrote: post #69

Earlier quoted context omitted.

> the PHP world always does this wrong because they're too focused on HTML. No. The PHP world recommends, time and time again, using PDO and binding variables to queries. I've yet to meet an individual who does it the other way, other than people who are relying on extremely outdated tutorials (7+ years ago). Hell, even this document does. This document, unfortunately, uses the word filter in the wrong way, but the i…

One thing I've run into is that PDO does not let you parameterize the field name in "ORDER BY" clauses. And there are a few other little things that I've wanted to do that it doesn't allow. It may be that me even running into these problems means I'm doing something wrong at a structural level. Regardless, in those statements where I want something to be dynamic, but it's not allowed by PDO, I do an exact equality ch…

Well, that's not what binding is supposed to do. After all, field names aren't something you should be exposing at all.

> I do an exact equality check against a white list.

Pretty much the way you are supposed to do it (except, I'd actually use the value in the white list rather than the matched input value, as the two should not be the same).

Re: PHP: The Right Way

#124

Post by zdw » Sun, Jul 08, 2012, 4:22 AM UTC

anthonyb wrote: post #88

zdw wrote: post #42

Earlier quoted context omitted.

RVM's installation is similar: https://rvm.io/rvm/install/ A far cry from the safer/verified "download this and check it's MD5 checksum" method that I'd prefer. Seriously, fixing package management so we can continuously integrate arbitrary code would be great. Getting arbitrary OS package creation to be almost as easy as pushing code to GitHub seems like a very worthy goal.

md5 is not going to protect you from much, especially if the md5 checksums are hosted on the same server. Also, pushing random code via apt-get is not going to win you any sysadmin friends. They like their servers to be stable, and their packages to be well tested.

Seeing as you can remove said code via apt, you'd likely win them over compared to the alternative of being told to install compilers or some other non package managed software bundler like cpan/rvm/npm that can't be canned and easily deployed.

Re: PHP: The Right Way

#125

Post by dlitz » Sun, Jul 08, 2012, 4:31 AM UTC

billpatrianakos wrote: post #90

gbog wrote: post #78

PHP with these guidelines looks like JAVA to me, but without the relatively sane foundations. It is fun how much a very old moralist sentence by Confucius applies well to PHP. He said 其本亂而末治者否矣 which can be translated, in software language development context, as "Build a nice, reliable language on shitty definition? Bullshit!". (The word-by-word translation is "your - root - messy - and/but - leaves/result - governe…

We get it, man. PHP sucks, you're cool/smarter/better because you use something else, and you need to remind us all about it by jumping in every time the letters P-H-P are seen in sequence to let us all know how it sucks by retreading the same old lines used by the last fifty guys who said the same thing but to your credit you really tried to be clever about it. A good portion of why people like to mock PHP is due to…

> A good portion of why people like to mock PHP is due to the way people end up using the language rather than the language's ugly parts.

Are you really going to trot out that old lie?

Why not read this, instead? http://me.veekun.com/blog/2012/04/09/php-a-fractal-of-bad-de...

Re: PHP: The Right Way

#126

Post by dlitz » Sun, Jul 08, 2012, 4:34 AM UTC

simonbrown wrote: post #106

phillmv wrote: post #102

Earlier quoted context omitted.

Well… Javascript does suck. No one in their right mind defends the language .

They do. http://www.joelonsoftware.com/items/2006/08/01.html http://skilldrick.co.uk/2010/09/why-javascript-is-awesome/

Javascript is just Scheme with a C-like syntax and a limited number of bad design decisions (like automatic semicolon insertion and the == operator). PHP is a never-ending fountain of bad design decisions, because its core devs continue to make new ones.

Re: PHP: The Right Way

#127

Post by smsm42 » Sun, Jul 08, 2012, 4:35 AM UTC

gbog wrote: post #78

PHP with these guidelines looks like JAVA to me, but without the relatively sane foundations. It is fun how much a very old moralist sentence by Confucius applies well to PHP. He said 其本亂而末治者否矣 which can be translated, in software language development context, as "Build a nice, reliable language on shitty definition? Bullshit!". (The word-by-word translation is "your - root - messy - and/but - leaves/result - governe…

This illustrates very common problem with people trying to criticize PHP.

First you demand some "foundations". But if you look on virtually all existing popular languages, none of them were designed exactly in the form they are now. Java had tons of changes and additions, Python had object model change and now has new version that changed so much that it's not even backwards compatible, etc. etc. Does it mean they lacked "sane foundations"? No, it means requirements changed, so did they. PHP changes too. You want formal definition of PHP? But what would be the benefit of it? Who would benefit from it existence? Without answering these questions it is hard to expect anybody would create it.

Then you proceed to focus on some obscure bug that 99.9999% people couldn't care less about, with implication that since this bug is not fixed whole language is crap. I don't even know how to address this - do you seriously expect this be taken as an argument?

Re: PHP: The Right Way

#128

Post by smsm42 » Sun, Jul 08, 2012, 4:39 AM UTC

kingkilr wrote: post #18

One point in and its already dead wrong, you never filter input, only output. Edit: Everyone talking about databases: paramaterized queries, check them out.

What's wrong with filtering input? If you expect a number, what's wrong with telling the user "strawberry pie" is not a valid value?

Re: PHP: The Right Way

#129

Post by smsm42 » Sun, Jul 08, 2012, 4:42 AM UTC

BadCRC wrote: post #14

These guidelines won't save you from some bullshit PHP "rules", such as: http://stackoverflow.com/questions/5810168/php-foreach-by-re...

There's no bullshit except in that code. If you use by-ref assignment and later try to re-use the same variable name, that's what you get. That's what by-ref binding is designed to do. If you don't understand it, re-read the manual on PHP references. It's not PHP fault if somebody doesn't use language properly.

Re: PHP: The Right Way

#130

Post by mcantor » Sun, Jul 08, 2012, 4:46 AM UTC

aw3c2 wrote: post #40

curl -s http://getcomposer.org/installer | php is creepy. Never ever run other people's code without at least giving it a glance.

Yeah... only idiots "sudo aptitude install" without reading and building from source first!