Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP 7 Virtual Machine

nikic.github.io

Post reply on HN
Print view View original

51–60 of 128 posts

Re: PHP 7 Virtual Machine

#51

Post by marcosdumay »

sbarre wrote: post #40
tannhaeuser wrote: post #22

Earlier quoted context omitted.

PHP started out as a language you could embed into otherwise static HTML via SGML processing instructions. While useful, the problem was (and still is) that embedded PHP templating operates at the string level and has absolutely no concept of HTML-awareness so can't escape the strings it injects into HTML - it's trivially easy to build a PHP app taking user input where the user sends malicious tags and PHP placing it…

> While useful, the problem was (and still is) that embedded PHP templating operates at the string level and has absolutely no concept of HTML-awareness so can't escape the strings it injects into HTML - it's trivially easy to build a PHP app taking user input where the user sends malicious tags and PHP placing it happily into generated HTML (eg. XSS attacks). > PHP apps typically also build up dynamic SQL from user…

It's not what you can do, it's how hard it is.

Just try pulling data from a database and inserting it into a page on a way that is vulnerable to XSS in Django, Jinja, or Rails. You obviously can do it, but I bet you'll need to spend half an hour reading the documentation before you succeed.

The same happens for SQL injection, and session management issues, and a huge amount of other problems.

Re: PHP 7 Virtual Machine

#52

Post by amiga-workbench »

malza wrote: post #36
donatj wrote: post #6

It's always pleasant to see PHP occasionally get a positive moment in the limelight on HN. It's oft scorned yet powers a very large chunk of the web. With the work done on 7 it's also one of the fastest scripting languages around and deserves a little more credit if I'm honest.

Honestly. I think its main problem is it's not hipster enough. It's too popular. I bet if you made it difficult to use (for most people), added features that make certain aspects a nightmare to scale and gave it a weird name then it would do well here. Obviously don't let anyone know about the origin... say you built it at a series of obscure coding bootcamps.

You hit the nail right on the head there.

Some of the nightmarish build configurations to get some Javascript projects going are just beyond belief.

Re: PHP 7 Virtual Machine

#53

Post by jeltz »

sbarre wrote: post #40
tannhaeuser wrote: post #22

Earlier quoted context omitted.

PHP started out as a language you could embed into otherwise static HTML via SGML processing instructions. While useful, the problem was (and still is) that embedded PHP templating operates at the string level and has absolutely no concept of HTML-awareness so can't escape the strings it injects into HTML - it's trivially easy to build a PHP app taking user input where the user sends malicious tags and PHP placing it…

> While useful, the problem was (and still is) that embedded PHP templating operates at the string level and has absolutely no concept of HTML-awareness so can't escape the strings it injects into HTML - it's trivially easy to build a PHP app taking user input where the user sends malicious tags and PHP placing it happily into generated HTML (eg. XSS attacks). > PHP apps typically also build up dynamic SQL from user…

Of course you can write safe code in PHP, it is a complete general purpose programming language. But just like one can blame C's design and standard library for many security bugs I also think it is fair to blame PHP's standard library and design.

For example PHP's PDO library makes it less convenient to supply parameters to a query the safe way than it is to do it the unsafe way. This is not necessary as can be seen from the excellent Ruby library called Sequel where it is just as easy to do things the safe way.

Another example is PHP itself being a template language, but which lack of automatic escaping makes it very dangerous to use. Since just one missing escape call in the wrong place can fuck up your day. To be fair PHP is not the only one who has fucked up here. This is also an issue with Ruby's ERB templates in the standard library, but fortunately Rails has added automatic escaping to its ERB templates.

One important thing about designing safe software is to make it easy for the end users to do things the right way, and here I think PHP has done a pretty poor job.

Re: PHP 7 Virtual Machine

#54

Post by tpetry »

marcosdumay wrote: post #51
sbarre wrote: post #40

Earlier quoted context omitted.

> While useful, the problem was (and still is) that embedded PHP templating operates at the string level and has absolutely no concept of HTML-awareness so can't escape the strings it injects into HTML - it's trivially easy to build a PHP app taking user input where the user sends malicious tags and PHP placing it happily into generated HTML (eg. XSS attacks). > PHP apps typically also build up dynamic SQL from user…

It's not what you can do, it's how hard it is. Just try pulling data from a database and inserting it into a page on a way that is vulnerable to XSS in Django, Jinja, or Rails. You obviously can do it, but I bet you'll need to spend half an hour reading the documentation before you succeed. The same happens for SQL injection, and session management issues, and a huge amount of other problems.

The fault in your argumentation is comparing a language (PHP) to a framework (Django, Jinja, Rails).

Your argument is valid too for any PHP framework, it's hard to do XSS in laravel, symfony or zend framework.

Re: PHP 7 Virtual Machine

#55

Post by bencoder »

fdsfsda7fsda wrote: post #29
DenisM wrote: post #10

Earlier quoted context omitted.

Perhaps you can send me down the righ path? I want my users to be able to send emails from their iPads, and those emails would be generated based on templates. There will be many such templates built in, and eventually users will be able to hire web developer-type person to make custom templates. My thinking was that PHP is the most popular language for that sort of thing, so it would be nice if could support that. M…

https://twig.sensiolabs.org/

I don't think there are implementations of twig outside of PHP, so this isn't useful for the op

Re: PHP 7 Virtual Machine

#56

Post by innocenat »

bpicolo wrote: post #50
matsemann wrote: post #45

Earlier quoted context omitted.

You're not refusing my point by insisting on adding more complexity (a huge framework), when simplicity and rapid prototyping of a small script was the goal. This question is what I mean, extra stuff one has to keep in mind: http://stackoverflow.com/q/5999373/923847 Does it matter for a real project? Probably not, just some boilerplate. Does it matter when I want something quick up and running? Yes.

> a huge framework I contest the idea that sinatra-style frameworks are "huge". Python + flask is about as low-overhead as one can get. No need to set up any extra (apache || nginx). PHP's model of "just chug along returning null" by disabling most relevant errors is a massive antipattern in production code.

PHP has lower overhead still. You don't need to import, explicitly define route, etc. PHP Built-in dev server doesn't require anything extra either.

Re: PHP 7 Virtual Machine

#57

Post by viraptor »

_wmd wrote: post #34
viraptor wrote: post #30

Earlier quoted context omitted.

That's not what the server-less idea is about. You're describing a standard shared hosting.

You're in software land, what is old is always new again. Try to dance around with the Wikipedia definition for serverless and get back to us when you've found a way to exclude the majority of old-style PHP hosting environments from it: > Serverless computing, also known as function as a service (FaaS), is a cloud computing code execution model in which the cloud provider fully manages starting and stopping of a func…

Big differences, with shared php hosting you get: (Yes, I'm sure there are exceptions, but they're... exceptions)

Payment per month not per usage. Normally there are usage tiers and a "you reached your limit" page rather than scaling.

No versioning beyond standard file operations.

No routing. You get all traffic in a single endpoint.

Only web traffic, no integration. Serverless in many cases is FaaS, with multiple event sources, not web-request-handler-aaS.

Sure, there are some similarities. But the use cases are completely different. Nobody is seriously considering "should I use AWS lambda, or GoDaddy shared PHP hosting?"

Re: PHP 7 Virtual Machine

#58

Post by bpicolo »

sbarre wrote: post #47
tannhaeuser wrote: post #42

Earlier quoted context omitted.

Reading through it, my comment came about too much as a rant against PHP, though I actually like parts of the PHP community for their sense of practicality. I know there are libraries for HTML escaping, but I stand behind my statement that PHP's lack of HTML escaping is a fatal and unforgivable (almost criminal) design flaw when PHP's original use case, and distinguished feature vs. other general-purpose languages is…

You're calling out problems that are common to all programming languages on the web, and I think you're just focused on PHP because it was one of the first languages to run into those problems (and to solve them as well - HTML escaping functions are part of PHP's core, it's not a library) due to it's early widespread popularity and adoption. Trailblazers often bear the brunt of learning through trial and error, and l…

> show me a popular web programming language that prevents the problems you called out (at the language level, not the framework level).

Golang? https://golang.org/pkg/text/template/

Re: PHP 7 Virtual Machine

#59

Post by Joeboy »

tpetry wrote: post #54
marcosdumay wrote: post #51

Earlier quoted context omitted.

It's not what you can do, it's how hard it is. Just try pulling data from a database and inserting it into a page on a way that is vulnerable to XSS in Django, Jinja, or Rails. You obviously can do it, but I bet you'll need to spend half an hour reading the documentation before you succeed. The same happens for SQL injection, and session management issues, and a huge amount of other problems.

The fault in your argumentation is comparing a language (PHP) to a framework (Django, Jinja, Rails). Your argument is valid too for any PHP framework, it's hard to do XSS in laravel, symfony or zend framework.

PHP is a web framework. It's just one that requires another framework on top to mitigate its shortcomings.

Re: PHP 7 Virtual Machine

#60

Post by innocenat »

agumonkey wrote: post #31
donatj wrote: post #6

It's always pleasant to see PHP occasionally get a positive moment in the limelight on HN. It's oft scorned yet powers a very large chunk of the web. With the work done on 7 it's also one of the fastest scripting languages around and deserves a little more credit if I'm honest.

Gotta admit that since the PHP ~6 days they made more than impressive efforts in many domains.

There weren't PHP6 though.
Post reply on HN