Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP 7 Released

github.com

Post reply on HN
Print view View original

241–250 of 317 posts

Re: PHP 7 Released

#241

Post by Diamons »

estefan wrote: post #228
Diamons wrote: post #190

Earlier quoted context omitted.

The numbers tell a different story. Wordpress powers 25% of the entire web. That is a quarter of the entire internet. It's pretty much your opinion vs the entire internet. You can see how your opinions come off as ludicrous ?

Not really. How many owners of those 25% of web sites are programmers who have any opinion whatsoever about programming languages?

Who cares about the coding language when the market is telling you otherwise? Isn't that the very essence of starting a startup, YCombinator, the whole Silicon Valley mantra? Listen to your customers.

The customers are telling you PHP is preferred to other languages and is here to stay as evidenced by 25% of the web using a single PHP application as the backend.

Re: PHP 7 Released

#243

Post by feld »

TazeTSchnitzel wrote: post #149
lsaferite wrote: post #94

I was so excited when I saw this post. Then I realized it's another 'too early' post claiming the tag == release. It's not released until it happens on the PHP site. This is just a tag in the repo. Sure, it likely won't change now, but it could.

It's not uncommon for released to be re-tagged, too.

and if you do this you deserve to burn in a fiery pit for being a bad bad bad release manager

If you tag a commit you better stick to your guns and never change it. You can't just re-tag or re-roll your releases because you found a bug. Bugs happen. Increment your version number, cut/tag a new release, and move on. You will never have a perfect release. Ever.

Re: PHP 7 Released

#244

Post by mikeash »

sarciszewski wrote: post #239
mikeash wrote: post #236

Earlier quoted context omitted.

Why not have the obvious API call for making a query only accept constant strings? You can still have an escape hatch for the rare cases where an expert needs to do something fancy, but hide it well and make it scary and you shouldn't have many problems.

Right, well, "constant strings" don't really exist in scripting languages, and before you mention objects that encapsulate them, what's to stop developers from building them elsewhere before passing the string to an object that encapsulates them? Chicken and egg. Education is the security strategy that pays forward the most.

Apologies, I meant string literals.

There's no technical reason the language couldn't make it so that string literals can be identified at runtime.

There are several good ways to put a stop to SQL injection. Better education is one, better APIs is another. There is no reason to just give up on the idea of using SQL queries directly because of injection attacks.

Re: PHP 7 Released

#246

Post by jwdunne »

I've been anticipating this for a while. Some great additions, especially scalar type hinting and type hinting on return types. The ability to enable stricter typing via a directive is also great. It's a shame internals voted down short-hand syntax for anonymous functions, including implicit closure over outer scope variables - a function with closures in PHP can get ugly very fast. Using higher-order functions becomes far more unwieldy.

Re: PHP 7 Released

#247

Post by timmy_ »

I use PHP for my freelance work mainly because I have no option on hosting. I never got the appeal for PHP (besides being cheap to host). All my personal projects are either done in Python or Node + (Angular, react & now Vue)

Python: PURE elegance

Node: io breeze

PHP: ?

Q: is the "module" system still achieved by dumping file content or is there a linking system?

Re: PHP 7 Released

#248

Post by sarciszewski »

mikeash wrote: post #244
sarciszewski wrote: post #239

Earlier quoted context omitted.

Right, well, "constant strings" don't really exist in scripting languages, and before you mention objects that encapsulate them, what's to stop developers from building them elsewhere before passing the string to an object that encapsulates them? Chicken and egg. Education is the security strategy that pays forward the most.

Apologies, I meant string literals. There's no technical reason the language couldn't make it so that string literals can be identified at runtime. There are several good ways to put a stop to SQL injection. Better education is one, better APIs is another. There is no reason to just give up on the idea of using SQL queries directly because of injection attacks.

Pop quiz: What is the singular cause of SQL injection, XSS, and stack overflows that causes a security vulnerability?

...

The answer is: Data being treated as an instruction.

Solution: Separate them so that data can never be interpreted as an instruction!

In SQLi, this solution is to use parameterized queries. You send the query in one packet, then the parameters in a second one. SQLi is thus prevented.

(Not that SQLi is the only vulnerability possible.)

Re: PHP 7 Released

#249

Post by Jemaclus »

GigabyteCoin wrote: post #245

Are they skipping 6.X releases or something? The latest release according to php.net [0] is 5.6.15 which come out October 29th of 2015. [0] https://secure.php.net/releases/

For a long time, there was a PHP6 in the works, but then HHVM and Hack came around and started making PHP6 look bad. There was another fork called PHP-NG, I believe, which went in a different direction. There was a huge pissing match in the internals list, and in the end, I think they threw threw out most of the PHP6 proposals and started fresh. To clear up matters, they skipped PHP6 and called it PHP7.

Don't quote me on that, but that's my understanding of it.

Re: PHP 7 Released

#250

Post by wmil »

sarciszewski wrote: post #116
trm42 wrote: post #101

Earlier quoted context omitted.

I could've done that but that wouldn't have taught the same things. PDO is awesome but requires deeper level of understanding (for a beginner), which may increase the frustration and may end up returning back to the mysql_query and co. It's easier point to framework that's already using PDO and and making sane defaults and solving bootstrapping problems. Once you've learned bunch of new concepts like ORM in one frame…

> PDO is awesome but requires deeper level of understanding (for a beginner), which may increase the frustration and may end up returning back to the mysql_query and co. Yeah, that's basically why I wrote EasyDB. https://github.com/paragonie/easydb $rows = $db->run('SELECT * FROM comments WHERE blogpostid = ? ORDER BY created ASC', $_GET['blogpostid']); foreach ($rows as $row) { // etc } Teach people to do things thi…

At the same time I understand why it would be more confusing for newbies.

In a language that already has string interpolation you're telling them to use a crappier custom version of string interpolation that's safe for databases.

Tutorials need to be more upfront about that.

Post reply on HN