Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP 7 Released

github.com

Post reply on HN
Print view View original

261–270 of 317 posts

Re: PHP 7 Released

#261

Post by sarciszewski »

mikeash wrote: post #257
sarciszewski wrote: post #248

Earlier quoted context omitted.

Pop quiz: What is the singular cause of SQL injection, XSS, and stack overflows that causes a security vulnerability? ... The answer is: Data being treated as an instruction. Solution: Separate them so that data can never be interpreted as an instruction! In SQLi, this solution is to use parameterized queries. You send the query in one packet, then the parameters in a second one. SQLi is thus prevented. (Not that SQL…

I'm not sure what your point is here, because what I'm advocating is precisely to make it easier to use parameterized queries and more difficult not to.

I wasn't being argumentative, I just thought that would be something worthwhile to add for people following along.

Re: PHP 7 Released

#262

Post by estefan »

Diamons wrote: post #241
estefan wrote: post #228

Earlier quoted context omitted.

Not really. How many owners of those 25% of web sites are programmers who have any opinion whatsoever about programming languages?

Who cares about the coding language when the market is telling you otherwise? Isn't that the very essence of starting a startup, YCombinator, the whole Silicon Valley mantra? Listen to your customers. The customers are telling you PHP is preferred to other languages and is here to stay as evidenced by 25% of the web using a single PHP application as the backend.

No the customers are saying they like the product (wordpress). They couldn't give a rat's ass what it's written in.

Re: PHP 7 Released

#263

Post by datasage »

sbarre wrote: post #53
aikah wrote: post #36

Earlier quoted context omitted.

> I actually met a young aspiring web developer who still learned DB-access with mysql_* functions. I urged him to switch to a sane framework like Laravel. Oh boy he was happy in a month and learned bunch of best practices quickly. There is some middle ground good practice which is using PDO, or even better Doctrine/DBAL . I don't think Laravel's ORM is that good, and the Active Record Pattern is somehow controversia…

I spent a good while trying to integrate Doctrine into my projects, and in the end I found it bloated and overly verbose and went back to PDO. I am sure that it has valid use cases, but for a lot of straightforward PHP projects, it's complete overkill and adds more work than it saves (in my opinion of course). I agree with knowing PDO though, I would say that's required knowledge for any self-respecting PHP developer…

Doctrine is great for keeping rails on developers of various skill levels in large projects. But it does come at a cost of overhead.

Most of the time for simple crud operations it doesn't matter, as long as you handle proxy generation and caching correctly. It can add up when you try to write code working on datasets.

In those cases, I bypass doctrine and go direct to SQL.

Re: PHP 7 Released

#264

Post by EGreg »

bpicolo wrote: post #223
sarciszewski wrote: post #116

Earlier quoted context omitted.

> PDO is awesome but requires deeper level of understanding (for a beginner), which may increase the frustration and may end up returning back to the mysql_query and co. Yeah, that's basically why I wrote EasyDB. https://github.com/paragonie/easydb $rows = $db->run('SELECT * FROM comments WHERE blogpostid = ? ORDER BY created ASC', $_GET['blogpostid']); foreach ($rows as $row) { // etc } Teach people to do things thi…

Yep. PDO still leaves room for string concatenation issues. Unfortunately, so does Doctrine.

Do you know any good PHP database frameworks that help you build up the query programmatically?

Over the years, we built one in-house at http://qbix.com/platform/guide/database because we couldn't find one. It does things like sharding out of the box, because it's able to understand the query's criteria and target it to the right shards.

Re: PHP 7 Released

#265

Post by sarciszewski »

appleflaxen wrote: post #259
sarciszewski wrote: post #119

Earlier quoted context omitted.

Yes, quote a blog post from NEARLY FOUR YEARS AGO that mostly consists of "I don't like the way this thing is so therefore it's wrong" + "This is a problem that was fixed in a later iteration of PHP" to justify why PHP 7 is bad. One thing I like about PHP 7 is that they had an opportunity to say "Fuck BC" and chose to use this version change to obsolete the shitty tutorials that make bad programmers (mysql_*).

Sorry to be dense... what is "BC"?

Sorry. "Backwards Compatibility."

Re: PHP 7 Released

#266

Post by EGreg »

brightball wrote: post #173
aarondf wrote: post #155

Earlier quoted context omitted.

> instead of playing to the language's advantages and using light-weight tools and libraries that would allow them to move faster. Depending on what you mean by "move faster", I may have to disagree. Besides a one-off script, I can't envision a scenario where using "tools and libraries" would allow you to move faster than using Laravel. Laravel comes with an unbelievable amount of stuff done for you, right out of the…

Laravel is an excellent Rails clone, but the entire problem with Laravel is that it's a PHP framework. I've been a PHP dev for 15 years and the biggest issue with frameworks in PHP is PHP itself. A request comes in, the PHP process loads up everything, executes the request and tears down...on every single request. In just about every other language, the application boots up, loads everything into RAM and each individ…

With caching, this is actually not such a big problem. The isolation is very good for resilience. Compare, for example, Node.js where a single exception can bring down your entire process and all the requests it's currently executing.

Is Laravel really a Rails clone? I thought that was Symfony. I honestly don't understand why the most popular PHP frameworks are all Rails clones. In my own work, I made things more in a PHP style than Ruby.

Re: PHP 7 Released

#267

Post by mikeash »

sarciszewski wrote: post #261
mikeash wrote: post #257

Earlier quoted context omitted.

I'm not sure what your point is here, because what I'm advocating is precisely to make it easier to use parameterized queries and more difficult not to.

I wasn't being argumentative, I just thought that would be something worthwhile to add for people following along.

Gotcha, sorry. "Pop quiz" always makes me think it's being sarcastic.

So, yes, total agreement there. Parameterized queries are key. I find it crazy that anything else ever existed, let alone still gets used.

Re: PHP 7 Released

#268

Post by sopooneo »

wmil wrote: post #250
sarciszewski wrote: post #116

Earlier quoted context omitted.

> PDO is awesome but requires deeper level of understanding (for a beginner), which may increase the frustration and may end up returning back to the mysql_query and co. Yeah, that's basically why I wrote EasyDB. https://github.com/paragonie/easydb $rows = $db->run('SELECT * FROM comments WHERE blogpostid = ? ORDER BY created ASC', $_GET['blogpostid']); foreach ($rows as $row) { // etc } Teach people to do things thi…

At the same time I understand why it would be more confusing for newbies. In a language that already has string interpolation you're telling them to use a crappier custom version of string interpolation that's safe for databases. Tutorials need to be more upfront about that.

But if the example above uses PDO underneath, then it's not just string interpolation though I think. It's sending the query and the parameters separately to the database, which is creating a "prepared data object" to plug the parameter values into.

I may be wrong, so please correct me if so.

Re: PHP 7 Released

#269

Post by [deleted] »

scotty79 wrote: post #57
aikah wrote: post #52

Earlier quoted context omitted.

> Number.parseInt is not that bad but I'll take to_json() global function instead of (new System.Web.Script.Serialization.JavaScriptSerializer()).Serialize() any day. It doesn't have to be one or the other. In fact, array functions could just be under the same static class, like Array::TheFunction() . It would be acceptable and limit chances of namespace collision .

> It doesn't have to be one or the other. Sure there's a spectrum. But even with one level I'm still guessing whether it was String.toInteger or Integer.toString, or String.parseInt or Integer.parseInt or Number.parseInt or whatever ... and since I need to check I don't mind finding out it's a global function named str2int or even int() that takes whatever.

[deleted]

Re: PHP 7 Released

#270

Post by Moru »

humbertomn wrote: post #168
jacquesm wrote: post #82

Earlier quoted context omitted.

That will never happen.

I know, but... "I just think those pointless discussions of languageA vs LanguageB are infinite loops and languageA + LanguageB would make both sides evolve faster and the whole community would gain in the end."

Once upon a time it was Atari/Amiga and before that it was a bunch of other smaller computers... Now it's languages and the arguments sounds just the same.
Post reply on HN