Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP 7 Virtual Machine

nikic.github.io

Post reply on HN
Print view View original

61–70 of 128 posts

Re: PHP 7 Virtual Machine

#61

Post by bpicolo »

innocenat wrote: post #56
bpicolo wrote: post #50

Earlier quoted context omitted.

> a huge framework I contest the idea that sinatra-style frameworks are "huge". Python + flask is about as low-overhead as one can get. No need to set up any extra (apache || nginx). PHP's model of "just chug along returning null" by disabling most relevant errors is a massive antipattern in production code.

PHP has lower overhead still. You don't need to import, explicitly define route, etc. PHP Built-in dev server doesn't require anything extra either.

I mean, it's "different", but I think it's a stretch to say lower. PHP overhead is suddenly a lot higher when you need a route with a dynamic ID in it if you're talking pure out-of-the-box, for example, which is a reasonably trivial use case.

Re: PHP 7 Virtual Machine

#62

Post by nilliams »

amiga-workbench wrote: post #52
malza wrote: post #36

Earlier quoted context omitted.

Honestly. I think its main problem is it's not hipster enough. It's too popular. I bet if you made it difficult to use (for most people), added features that make certain aspects a nightmare to scale and gave it a weird name then it would do well here. Obviously don't let anyone know about the origin... say you built it at a series of obscure coding bootcamps.

You hit the nail right on the head there. Some of the nightmarish build configurations to get some Javascript projects going are just beyond belief.

It's unfortunate if you've encountered that because there's really no good reason for it. Thankfully now however most/all major JS frameworks & libs are moving to/have moved to 'zero configuration' cli tools (ember-cli, create-react-app, angular-cli, ...).

Re: PHP 7 Virtual Machine

#63

Post by mproy »

krick wrote: post #19
improv32 wrote: post #8

Earlier quoted context omitted.

PHP is a whole lot more than just a templating engine. I think you would find that much more effort than is required just to make some templates.

I actually assumed this is a joke/trolling attempt, since it was a common joke to despisingly call PHP a "templating engine" a few years ago. But the follow-up seems so sincere that I don't even know what to think anymore...

That's the problem with trolling and hyberbole on any subject. People take it at face value and it becomes the popular narrative.

Re: PHP 7 Virtual Machine

#64

Post by Prefinem »

jeltz wrote: post #53
sbarre wrote: post #40

Earlier quoted context omitted.

> While useful, the problem was (and still is) that embedded PHP templating operates at the string level and has absolutely no concept of HTML-awareness so can't escape the strings it injects into HTML - it's trivially easy to build a PHP app taking user input where the user sends malicious tags and PHP placing it happily into generated HTML (eg. XSS attacks). > PHP apps typically also build up dynamic SQL from user…

Of course you can write safe code in PHP, it is a complete general purpose programming language. But just like one can blame C's design and standard library for many security bugs I also think it is fair to blame PHP's standard library and design. For example PHP's PDO library makes it less convenient to supply parameters to a query the safe way than it is to do it the unsafe way. This is not necessary as can be seen…

I would say it's unfair to compare a library to the basic PDO. If you want to compare apples to apples, try looking at Sequel versus Doctrine or some other third party SQL library.

Just like any other template language (thinking of something like ColdFusion or ASP), of course one unescaped variable is going to be a headache. But you don't have to use it that way, and probably shouldn't. While PHP started as a template language, it has clearly moved past that.

Re: PHP 7 Virtual Machine

#65

Post by agumonkey »

innocenat wrote: post #60
agumonkey wrote: post #31

Earlier quoted context omitted.

Gotta admit that since the PHP ~6 days they made more than impressive efforts in many domains.

There weren't PHP6 though.

hence the ~

IIRC it's after that time that PHP saw very important changes vm and language.

Re: PHP 7 Virtual Machine

#66

Post by Prefinem »

Joeboy wrote: post #59
tpetry wrote: post #54

Earlier quoted context omitted.

The fault in your argumentation is comparing a language (PHP) to a framework (Django, Jinja, Rails). Your argument is valid too for any PHP framework, it's hard to do XSS in laravel, symfony or zend framework.

PHP is a web framework. It's just one that requires another framework on top to mitigate its shortcomings.

I use PHP quite a bit outside of the web.

I think tpetry was pointing out the difference between a language and a framework built on that language.

(Replace language with whatever you think it is, it's still a subset just like Ruby on Rails is a subset of Ruby)

Re: PHP 7 Virtual Machine

#67

Post by geon »

LinuxFreedom wrote: post #37
geon wrote: post #21

Earlier quoted context omitted.

> PHP iirc can't even be used as a websocket server True, if you run it behind a web server like 99.999% of all users. If you run it as a cli script, you can implement pretty much anything. I saw a ftp server once. Crazy. Still, even on a normal web server, php can do long polling perfectly fine, which is often enough. > being able to write program flows without dozens of promises is a breeze It is a breeze with asyn…

what would be a good hardware spec and server configuration to have 5000 users do long polling with a php backend?

If you care about performance and traffic, perhaps php isn't where you should start anyway.

Re: PHP 7 Virtual Machine

#68

Post by david-given »

aphextron wrote: post #17
donatj wrote: post #6

It's always pleasant to see PHP occasionally get a positive moment in the limelight on HN. It's oft scorned yet powers a very large chunk of the web. With the work done on 7 it's also one of the fastest scripting languages around and deserves a little more credit if I'm honest.

It has come a long way. My last job was at a big PHP shop, which had a heavy focus on doing PHP The Right Way. The result was a fairly decent, maintainable codebase. I came to really appreciate the flexibility and ability to just "make things work" that PHP has, while finally having a proper development environment with real dependency management and IDE support.

Do you have any pointers to the recommended Right Way to do modern PHP? I'd be interested to explore it; I have a number of places where I want to add tiny bits of interactivity to otherwise static web pages, and this totally seems to be what PHP does best.

Re: PHP 7 Virtual Machine

#69

Post by sbarre »

jeltz wrote: post #53
sbarre wrote: post #40

Earlier quoted context omitted.

> While useful, the problem was (and still is) that embedded PHP templating operates at the string level and has absolutely no concept of HTML-awareness so can't escape the strings it injects into HTML - it's trivially easy to build a PHP app taking user input where the user sends malicious tags and PHP placing it happily into generated HTML (eg. XSS attacks). > PHP apps typically also build up dynamic SQL from user…

Of course you can write safe code in PHP, it is a complete general purpose programming language. But just like one can blame C's design and standard library for many security bugs I also think it is fair to blame PHP's standard library and design. For example PHP's PDO library makes it less convenient to supply parameters to a query the safe way than it is to do it the unsafe way. This is not necessary as can be seen…

Most languages let you cut corners and code in a sloppy way. This is not limited to PHP.

I think anyone can show anecdotes to support "coding in [language you don't like] is bad".

Replace "unsafe" with "non-performant" and go back to early Rails days and you'll have plenty of examples where naive framework implementation led to programmers shooting themselves in the foot with the "easy way" in a different context..

Like I said, all languages and frameworks have their caveats and learning to code properly is the developer's job, and the "right way" or "best way" is often a work in progress that evolves as the community develops best practices..

Re: PHP 7 Virtual Machine

#70

Post by Joeboy »

Prefinem wrote: post #66
Joeboy wrote: post #59

Earlier quoted context omitted.

PHP is a web framework. It's just one that requires another framework on top to mitigate its shortcomings.

I use PHP quite a bit outside of the web. I think tpetry was pointing out the difference between a language and a framework built on that language. (Replace language with whatever you think it is, it's still a subset just like Ruby on Rails is a subset of Ruby)

And I'm pointing out that treating PHP as a framework is not a "flaw in argumentation". The default installation of PHP gives you a setup that parses HTTP requests and returns HTTP responses, and provides a bunch of web-centric functionality in between. ie. it's a web framework, albeit not a very good one.
Post reply on HN