Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yii Framework 2.0.0 GA

yiiframework.com

Post reply on HN
Print view View original

31–40 of 55 posts

Re: Yii Framework 2.0.0 GA

#31

Post by girvo »

krapp wrote: post #12
kijin wrote: post #11

> Yii 2.0 helps you to write more secure code. It has built-in support to prevent SQL injections, XSS attacks ... This is just a minor complaint, but it's so pervasive among web frameworks that I must complain yet again. According to the documentation for Yii 2.0, the recommended way to output a variable to a web page is: Not the PHP standard: Because if you do the latter, you will be vulnerable to XSS. But why does…

Twig, at least, escapes by default. Laravel's Blade templates don't, unless that's changed recently. But the price you pay for that of course is no longer working directly in PHP but a templating language with its own syntax (for instance, array shorthand in Twig templates [] has worked since I don't know when but only recently has PHP gotten around to supporting it) which has to be parsed, and partially compiled int…

> but only recently has PHP gotten around to supporting it

You're talking about the `[]` short-hand for arrays, right? That was released in version 5.4, in March 2012, I wouldn't really say that's "recent", at least in my opinion.

Re: Yii Framework 2.0.0 GA

#32

Post by blowski »

adoming3 wrote: post #6

I'm a Yii fan but it takes some time learning the "yii" way of doing things i.e. structure, naming conventions. I decided to move on though because the community and module ecosystem are small.

Same as me. I relied on it heavily around 2010, but their glacial development made Symfony a better choice in 2012.

Re: Yii Framework 2.0.0 GA

#33

Post by blowski »

ugdev wrote: post #9
gesman wrote: post #4

vs. Laravel? anyone?

I would also here some experts opinions on this. How do they compare on a higher level. Say a RESTful API with JSON+HAL, HATEOAS approach, Versioning, etc. the full thing for a bigger usecase like Twitter, Tumblr, Facebook, etc.

Comparing to Facebook and Twitter is a useless comparison, because their scale causes so many edge cases. If you have that kind of scale, you can afford to hire the best in every area and build everything from scratch. Better to compare to a typical medium-sized website in a similar sector - e.g. a blog like cuteoverload.com or ecommerce site like tigerdirect.com.

Re: Yii Framework 2.0.0 GA

#34

Post by samdark »

adoming3 wrote: post #6

I'm a Yii fan but it takes some time learning the "yii" way of doing things i.e. structure, naming conventions. I decided to move on though because the community and module ecosystem are small.

You've meant "were small in 2008"?

Re: Yii Framework 2.0.0 GA

#36

Post by samdark »

kijin wrote: post #11

> Yii 2.0 helps you to write more secure code. It has built-in support to prevent SQL injections, XSS attacks ... This is just a minor complaint, but it's so pervasive among web frameworks that I must complain yet again. According to the documentation for Yii 2.0, the recommended way to output a variable to a web page is: Not the PHP standard: Because if you do the latter, you will be vulnerable to XSS. But why does…

The cost for auto-escaping everything is too high:

1. You're no longer using PHP. btw., Yii supports Twig that escapes everything by default. 2. Performancewise it's quite a bit hit.

Re: Yii Framework 2.0.0 GA

#37

Post by samdark »

gesman wrote: post #4

vs. Laravel? anyone?

I can persuade you to use any of these two frameworks providing lots of arguments but I prefer not to do so. Try both yourself else you'll be wondering if you've made the right choice while working with one.

Re: Yii Framework 2.0.0 GA

#38

Post by windowsworkstoo »

girvo wrote: post #30
bigtunacan wrote: post #20

Earlier quoted context omitted.

That seems to be missing the whole point of symbols/atoms. They are uniquely identified with an O(1) lookup time and persist in memory after the initial creation. Symbols persist across multiple requests; this is a big part of why they are so beneficial.

I'm not disagreeing with you, but > Symbols persist across multiple requests; this is a big part of why they are so beneficial. That is still not really useful, PHP throws the entire execution context away after the request has finished. There is no sharing nor anything to persist unless you're doing so with an external data-store.

Wait, isn't that just if it's used/configured as a CGI? If you use it as a webserver module (Apache/IIS/Lightspeed), the execution environment can persist in a similar way to an app domain, right?

Re: Yii Framework 2.0.0 GA

#39

Post by coldtea »

windowsworkstoo wrote: post #38
girvo wrote: post #30

Earlier quoted context omitted.

I'm not disagreeing with you, but > Symbols persist across multiple requests; this is a big part of why they are so beneficial. That is still not really useful, PHP throws the entire execution context away after the request has finished. There is no sharing nor anything to persist unless you're doing so with an external data-store.

Wait, isn't that just if it's used/configured as a CGI? If you use it as a webserver module (Apache/IIS/Lightspeed), the execution environment can persist in a similar way to an app domain, right?

Nope, it's still cleared at the end of the request (as it should be, this is not a bug or mis-feature, and is actually one of the things PHP got right for scalable apps).

What doesn't happen compared to CGI, IIRC, is loading the whole PHP engine from the start for every invocation. But no request specific memory is ever shared between invocations.

Re: Yii Framework 2.0.0 GA

#40

Post by coldtea »

pestaa wrote: post #19
lmz wrote: post #18

Earlier quoted context omitted.

It's a bit silly to worry about the overhead of strings over symbols when the PHP environment itself is not persistent across requests.

It adds up. One request may produce millions of such strings. Ruby and especially RoR without cheap symbol lookups would be as fast as a dead fish.

You're not supposed to have "millions of symbols" in Ruby (or LISP for that matter) either.

I mean, you technically could, but it's not what they are used for.

Post reply on HN