Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP: The Right Way

phptherightway.com

Post reply on HN
Print view View original

91–100 of 233 posts

Re: PHP: The Right Way

#91

Post by nbm »

socratic wrote: post #81

Are there any good books (or other resources) on modern PHP? I last used PHP back with PHP3 (and then went C++ => Java => Python => Python/JavaScript => Ruby => Python/R), but a bunch of code I want to read at work uses PHP (with Zend). I no longer remember most of what I learned about PHP3, though obviously the PHP syntax seems to be at least somewhat readable as a sort of amalgam of Perl and C++ syntax and idioms.…

As far as I know, at Facebook we don't give pre-emptively/usually give people a book to learn PHP. Those that don't know PHP (or are rusty) can generally get the syntax/keywords right in an hour, and then there's a longer time spent getting familiar with both the standard library and our own frameworks/libraries.

There is a lot of good code to look at and learn from, and the Bootcamp program teaches a bunch of our own library and some guidance on what good and bad standard library functions are for certain cases. We also have a "newbie" group where people can ask questions about the codebase. And if you do something without knowledge of a built-in (or Facebook) function/class and make things more complex than they need to be, your code reviewer will let you know how to do it easier/more idiomatically. Every once in a while there are language tech talks, and sometimes even whole-day training sessions (we did one on exciting new C++11 features).

Besides that, I definitely spent a lot of my time with php.net/function_name open and exploring when I couldn't remember all the functions available or the parameters and order.

Re: PHP: The Right Way

#92

Post by mikeash »

billpatrianakos wrote: post #90
gbog wrote: post #78

PHP with these guidelines looks like JAVA to me, but without the relatively sane foundations. It is fun how much a very old moralist sentence by Confucius applies well to PHP. He said 其本亂而末治者否矣 which can be translated, in software language development context, as "Build a nice, reliable language on shitty definition? Bullshit!". (The word-by-word translation is "your - root - messy - and/but - leaves/result - governe…

We get it, man. PHP sucks, you're cool/smarter/better because you use something else, and you need to remind us all about it by jumping in every time the letters P-H-P are seen in sequence to let us all know how it sucks by retreading the same old lines used by the last fifty guys who said the same thing but to your credit you really tried to be clever about it. A good portion of why people like to mock PHP is due to…

Yes, how dare he talk about the problems with PHP in the comments on a site dedicated to talking about how to avoid problems with PHP. Seriously, WTF? Are people actually offended that discussion of PHP's defects take place in a conversation about PHP best practices?

Re: PHP: The Right Way

#93

Post by anthonyb »

_ikke_ wrote: post #9

I'm wondering why a specific code style is 'enforced' while it has nothing to do with interoperability. Libraries with different code styles can be used together without problems. It seems like they are using the PSR to declare they're own style as superior.

It does help improve your interoperability with other developers and other code though.

Python has had PEP-8 for quite a while now, and it definitely helps in improving both code quality and understanding random libraries that you find on the internet. It doesn't catch everything, but then that's what Pylint is for.

Re: PHP: The Right Way

#94

Post by anthonyb »

Dylan16807 wrote: post #77
jasonlotito wrote: post #67

Earlier quoted context omitted.

Not sure if you are trying to make a joke (and if so, it's incredibly subtle), or you are being serious. In case you are serious, to explain how HTTPS as it's used means anything about the trust-worthiness of the two parties involved?

Look at the original post. "curl -s http://getcomposer.org/installer | php" It's not just about trusting Composer, it's about trusting every point between you and their server. If I want to know that I am actually executing Composer I need to use a secure download method.

It does not help you if the originating server has been hacked, which is by far the most likely attack vector (after people being assholes on the internet or making mistakes in their script).

Protecting against that is the whole fucking point of using things like apt-get/PEAR and GPG/code signing.

Re: PHP: The Right Way

#95

Post by LeonidasXIV »

wvenable wrote: post #39
kingkilr wrote: post #18

One point in and its already dead wrong, you never filter input, only output. Edit: Everyone talking about databases: paramaterized queries, check them out.

You've been downvoted but I completely agree. You cannot sanitize text for all possible situations; you can only escape it depending on the output format (database, html, etc). These functions should be used to "validate" input rather than "filter" it.

I absolutely hate how for example phpBB creates garbled bbcode in the database because they thought that they should filter it or something, instead of doing it on output now every consumer of the data has to unfuck the content, because they messed up.

Re: PHP: The Right Way

#96

Post by LnxPrgr3 »

xd wrote: post #74
LnxPrgr3 wrote: post #59

Earlier quoted context omitted.

C lets you define variables with block scope: int main(int argc, char *argv[]) { for(int i=0;i The last line fails to compile—'i' is no longer defined after exiting the loop. Java: public static void main(String[] args) { for(int i=0;i That also won't compile. Coming from a language that supports variables with block scope, PHP's behavior is very surprising indeed. If the first mention of $object is in the loop, I ca…

I was thinking more of: #include int main() { int arr[10] = {1,2,3,4,5,6,7,8,9,0}, *ptr; for(int i = 10; i>=0; i--) { ptr = &arr[i]; printf("%d\n", *ptr); } printf("%d\n", *ptr); }

Sure, but you defined ptr outside of the loop. Who defined $object outside of the loop in the PHP example?

Also note that, in C, you have to explicitly dereference pointers:

  ptr = 42;
You should get a warning from your compiler if you try that. PHP effectively goes ahead and changes it to:

  *ptr = 42;
Perl requires you to explicitly dereference references as well:

  @array = ('c', 'c++', 'java', 'perl');
  $item = \$array[3];
  $item = 'php'; # Does NOT replace the item in the array
  foreach $item (@array) {
      print $item . "\n";
  }
PHP is weird in this regard: if you ever assign a reference to a variable, later assignments go through that reference automatically. To convert the variable back to a normal variable, you have to unset it. I don't know of another language that acts like this. Can you think of one?

Combine that with the lack of block scope, and you get surprises like the example BadCRC linked.

Re: PHP: The Right Way

#97

Post by Getahobby »

mikeash wrote: post #92
billpatrianakos wrote: post #90

Earlier quoted context omitted.

We get it, man. PHP sucks, you're cool/smarter/better because you use something else, and you need to remind us all about it by jumping in every time the letters P-H-P are seen in sequence to let us all know how it sucks by retreading the same old lines used by the last fifty guys who said the same thing but to your credit you really tried to be clever about it. A good portion of why people like to mock PHP is due to…

Yes, how dare he talk about the problems with PHP in the comments on a site dedicated to talking about how to avoid problems with PHP. Seriously, WTF? Are people actually offended that discussion of PHP's defects take place in a conversation about PHP best practices?

I think it is because we (as a community) should be past the piling-on stage and on to the constructive discussion stage. Snark doesn't add to the discussion.

Re: PHP: The Right Way

#98

Post by anthonyb »

chrismsnz wrote: post #86
codeguy wrote: post #41

Earlier quoted context omitted.

haha. Always good advice. But I checked. It's fine :)

It's fine now until someone hacks their site or poisons their DNS.

Or writes a script which checks the user agent and only serves up malware to curl.

Or the second time that an IP address hits it.

Or something else that you haven't thought of.

Update: Such as doing something nasty to http://getcomposer.org/composer.phar instead - a 520KB php file that the first script downloads and runs without even md5ing first. Did you audit that too? Did you understand everything that it was doing?

Re: PHP: The Right Way

#99

Post by drivebyacct2 »

LnxPrgr3 wrote: post #59
xd wrote: post #17

Earlier quoted context omitted.

How is that a "bullshit PHP rule"? If you for loop in C, setting a pointer each iteration, you would expect the pointer to still be set the the last assignment in the loop once you're out of it.

C lets you define variables with block scope: int main(int argc, char *argv[]) { for(int i=0;i The last line fails to compile—'i' is no longer defined after exiting the loop. Java: public static void main(String[] args) { for(int i=0;i That also won't compile. Coming from a language that supports variables with block scope, PHP's behavior is very surprising indeed. If the first mention of $object is in the loop, I ca…

I'm just upset that you don't have braces around the inner body of your `for` statements. I want to edit the DOM just to fix it.

Re: PHP: The Right Way

#100

Post by pixelbath »

mikeash wrote: post #92
billpatrianakos wrote: post #90

Earlier quoted context omitted.

We get it, man. PHP sucks, you're cool/smarter/better because you use something else, and you need to remind us all about it by jumping in every time the letters P-H-P are seen in sequence to let us all know how it sucks by retreading the same old lines used by the last fifty guys who said the same thing but to your credit you really tried to be clever about it. A good portion of why people like to mock PHP is due to…

Yes, how dare he talk about the problems with PHP in the comments on a site dedicated to talking about how to avoid problems with PHP. Seriously, WTF? Are people actually offended that discussion of PHP's defects take place in a conversation about PHP best practices?

Offended, no. Weary of rehashing the same arguments against using PHP at all, when that is clearly not the point of the discussion...absolutely.
Post reply on HN