Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP 7 deployment at Dailymotion

engineering.dailymotion.com

Post reply on HN
Print view View original

141–150 of 166 posts

Re: PHP 7 deployment at Dailymotion

#141

Post by krapp »

Akujin wrote: post #38
nikcub wrote: post #14

Hack and HHVM solves what is, IMO, the worst feature of the default PHP runtime environment[0] - and that is the superglobals. It wasn't mentioned in the post from Slack, but default superglobals and the earlier register_globals design decisions are the worst and most impactful wart in PHP. Because it was designed as a templating language, the default web server interface, which is CGI - will auto-expose all variable…

I don't get why people keep harping on super globals are being inherently bad. The variables are there. You can use them or ignore them. A variable definition harms you in no way other than a tiny bit of memory usage which is capped by the HTTP limit on POST and GET limits anyway. What? You think you're gonna get hacked because $_POST['ihaxyou'] is set to 'w00ts'? No one does this anymore: mysql_query("SELECT * FROM…

>No one does this anymore: >mysql_query("SELECT * FROM `table` WHERE `id`=".$_POST['ID']);

People do still write PHP like this, because they aren't even aware that SQL injection is a thing. I've seen it in code written relatively recently.

>Are you expecting it to be an integer? Easy >if(!ctype_digit($_POST['ID'])) { // throw exception here }

You forgot to check that the index "ID" exists first, that will throw a warning if it doesn't.

>Contrary to the hive mind you don't need some special encapsulation class to pull your post and get variables.

You don't need it,but encapsulation is still useful. You may want to use some source other than the superglobals, maybe for testing.

>What's with people expecting frameworks to do everything for them these days?

Frameworks are supposed to come with proper data validation out of the box - if they don't, they're bad frameworks.

Re: PHP 7 deployment at Dailymotion

#142

Post by user5994461 »

corobo wrote: post #115
babyrainbow wrote: post #93

Earlier quoted context omitted.

>You have a point though. I used this internet thing about 17 years ago, it was terrible. Only dial-up. SLOW! And don't talk to me about browsers. Netscape? Internet Explorer? Ugh. Forget it. I don't care what they might have changed, or replaced or completely removed, its always terrible. We have only one Internet. But we have a lot of alternatives for Php to choose from. If you have an Internet provider that gave y…

After 12 years? I wouldn't consider them to be the exact same as when I left them at least.

Left C 12 years ago...Came back to C this year. That's still the exact same thing.

Re: PHP 7 deployment at Dailymotion

#143

Post by stephenr »

Drdrdrq wrote: post #136
corobo wrote: post #129

Earlier quoted context omitted.

I'll be honest I don't really care what languages people use, not my place to convince you back. Just saying there's quite high chances PHP has changed at least a tiny bit over the past 12 years

I started using PHP when it was in version 3 and still use it occassionally. It has changed, but not considerably. The function naming is still a mess (backwards compatibility), arrays are completely inappropriate (naming them "bags" would be better), some decisions were so baffling (safe mode and magic quotes, superglobals, square brackets for arrays...) that I simply don't trust PHP to ever get better. But there wa…

If php3 to php7 isn't a considerable change to you, I'm not sure any change to anything ever, would register as a change for you, would it?

Re: PHP 7 deployment at Dailymotion

#144

Post by kyriakos »

nkozyra wrote: post #121
kyriakos wrote: post #65

Earlier quoted context omitted.

A much needed overhaul to the utility functions (array, strings etc) should be the next step.

Of course, but they won't do that because of backwards compatibility and I get that. It's one of the nice parts of rebranding. Hack could keep and throw out anything they wanted because it was intended for private FB use. At some point, PHP will have to start cutting off the stdlib PHP4.x warts. There's enough about PHP 7 that's good enough to be compelling to anyone working in an interpreted language on the web, but…

They don't have to remove them. Just put the updated versions under a namespace. This will slowly help developers migrate.

Re: PHP 7 deployment at Dailymotion

#145

Post by takeda »

gnud wrote: post #92
nikcub wrote: post #14

Hack and HHVM solves what is, IMO, the worst feature of the default PHP runtime environment[0] - and that is the superglobals. It wasn't mentioned in the post from Slack, but default superglobals and the earlier register_globals design decisions are the worst and most impactful wart in PHP. Because it was designed as a templating language, the default web server interface, which is CGI - will auto-expose all variable…

I'm not a huge fan of the superglobals - but the correct fix here is to use a parameterized query! I'm not sure which languages you are used to, that will somehow magically 'escape' an input string so that it's safe to inject directly into your query in all circumstances. I know I don't want strings from the frontend pre-quoted in any way. I want the string the way the user typed it in!

I'm sad that I had to scroll that much down to get to this response. Any other approach is still not secure, might output strange characters for specific inputs or both.

Re: PHP 7 deployment at Dailymotion

#146

Post by Zarel »

marklgr wrote: post #118
babyrainbow wrote: post #99

Earlier quoted context omitted.

Well, It is not that easy. For example, take the function strlen(). You can see that it is a wrapper for the C function. So can you expect that it will behave like the c function, accepting strings only? No! It now accept both strings and integers. So you have part perl there. Now take another function. ctype_digit(). I don't know where the name come from. You expect it to behave like strlen() accepting both strings…

It's more about automatic type conversion than the API, though; numerics magically get converted to strings and vice-versa. This is convenient in some cases, especially for beginners who don't have to think about types, but it eventually bites you if you never realize what happens in your back.

The problem is that ctype_digit does not magically get converted to a string, it instead just returns gibberish.

If ctype_digit(100) magically got converted to ctype_digit('100'), that would not be a problem.

Re: PHP 7 deployment at Dailymotion

#147

Post by nilliams »

wwweston wrote: post #130
Aaargh20318 wrote: post #124

Earlier quoted context omitted.

> There's absolutely NOTHING wrong with having $_POST['whatever'] inside a controller as long as you're doing proper checks. The last part is why this is a problem. The truth is that programming is simply too difficult a task for human beings. Software is so complicated with so many moving parts that it is impossible for anyone to understand all the details of even the simplest piece of code. This is why we have oper…

> The last part is why this is a problem. $_POST isn't the problem. The scope of the variable isn't the problem. You've realized this, too, and that's why you're shifting the argument to one about typing instead of superglobals-are-bad (typing and scope are obviously independent features). > You want to reduce the number of things you have to think about to the absolute minimum The net effect of type systems seems to…

Parent did not 'shift the argument to one about typing instead of superglobals-are-bad' as I read it.

They said superglobals are bad because they make it too easy to do the wrong thing.

And the followup was about how often people do the wrong thing.

If you interpreted that any other way you misread (afaict).

Re: PHP 7 deployment at Dailymotion

#148

Post by nilliams »

Akujin wrote: post #49
wdewind wrote: post #41

Earlier quoted context omitted.

> Contrary to the hive mind you don't need some special encapsulation class to pull your post and get variables. The hive mind is like that for a reason. Making it easy to do the right thing and wrong to do the wrong thing has massive effects, I'd argue the magnitude of which scale exponentially with the growth of an engineering team. Really really talented engineers make mistakes all the time. To the extent that we…

I think people are also confusing an old issue from PHP 4.x where if you had $_POST['somevar'] it would actually have an alias automatically set as $somevar in the global userspace. This was turned off by default a long time ago and is the main real security issue when it comes to super globals. $_POST and $_GET are just the normal way to access POST and GET vars. There's nothing inherently insecure about it.

I don't think people are confusing those things at all. The comment you're replying to is quite literally saying that using $_POST['somevar'] is too easy.

Re: PHP 7 deployment at Dailymotion

#149

Post by jonaswouters »

toxican wrote: post #16
wyager wrote: post #10

Earlier quoted context omitted.

Don't take attacks on your usual tool of choice as an attack on yourself. If you think people are making good arguments against PHP, perhaps consider retooling a bit...

Hard to separate yourself from your decisions and your toolset sometimes! I certainly may check out some alternatives at a hobby level and pursue them further if they appeal to me. But for now the money in my rural city is in PHP and to a lesser extend, .NET. Don't think I've ever seen a job asking for Python, Node, etc. that didn't require an hour + commute.

If you jump on a new language early enough and are proficient enough to be productive in it, you have a chance to actually land some jobs with it without having to take a pay cut. Letting people know and engaging in the community is a requirement though.

You'll meet other people passionate about it and ultimately network is everything ;)

Then again I end up with php jobs anyway because I enjoy sharing my knowledge (coaching, improving way of working, etc) but at the same time surround myself with people who I can learn from. (Be it business, architecture or a different language, all relative knowledge is valuable)

Re: PHP 7 deployment at Dailymotion

#150

Post by wyager »

lsaferite wrote: post #120
wyager wrote: post #71

Earlier quoted context omitted.

This is the most pernicious and annoying technicality that advocates of low-quality languages invoke. PHP does not actively work against bad or just plain wrong code, and its construction actively encourages bad code. It's missing aspects that we know to be tremendously useful for writing high-quality correct code. You can write low-quality software in e.g. rust, but you're going to work a lot harder at it. Rust (aga…

So, I generally don't wade into this argument. I've been programming for 27 years, 12 of that professionally. In that time I've used a lot of languages for a lot of projects. Every language is capable of being used to shoot yourself in the foot TBH. The hate that PHP gets is, IMHO, mostly from the fact that it's a gateway language and as such often has a higher WTF per minute rate for the code you find than many othe…

Let's start with this:

How would you describe the difference between PHP and assembly? Why is one better than the other in certain cases?

Post reply on HN