4 ms·

Things You Probably Didn’t Know About PHP

28 points by vladocar 17y ago

encoderer 17y ago
This is a good list for developers new to PHP. Most lists that target that group tend to have a lot of outdated, wrong information; optimizations that were important for PHP4 but irrelevant today. This one seems to skirt that. One change I would make is to use the very effective Filter Input library to check an email address before you check it's DNS record. It would prevent a costly DNS hit if the email address is just gibberish. Edit: For the criticism below (and unexplicable down-mods), take note that I didn't say this is a good list for new developers. I said this is a good list for developers new to PHP
- mootothemax 17y ago
  I disagree, I think this kind of list is another reason why new developers write poor PHP code. For example, as you highlight, there's no mention of checking to see if the string is an email address before taking the DNS hit. Then number 1: what's the point of having a long string stored in the database if it's compressed? Either put it there so you can search with it or store it on the local filesystem. 5. Why on earth should we be encouraging people to write code like this? 6. The same point, and even the list's author doesn't know what's going on here. He's using variable variables, e.g. $cow = "ermintrude"; $dog = "wuffles"; $animal = "cow"; echo $$animal; //outputs ermintrude echo ${"dog"}; //output wuffles As I say, new developers don't need these features and shouldn't be using them. For that matter, I don't think any developer should be using the features I mention above: am I wrong?
  - ddbb 17y ago
    The reason they write poor code is because they are beginners and beginners always make mistakes, use functions incorrectly, etc. In any language they code, not just PHP. PHP is often more visible because it is more used and easier to write... But if PHP wasn't that popular, we would see the same issue with Perl, Python, etc.
    - wendroid 17y ago
      PHP encourages shitty code because it is already shitty code in a shitty language. It's the broken windows effect. All you need to know is from Rasmus himself "There are people who actually like programming. I don't understand why they like programming." see also his other gems http://en.wikiquote.org/wiki/Rasmus_Lerdorf http://en.wikiquote.org/wiki/Rasmus_Lerdorf
      - encoderer 17y ago
        The broken window effect? Really? PHP is far from my favorite language but "language wars" and comments like yours that lead to them are 100% brain dead. Void of original thought. I see a little irony in people like you cursing PHP as unnecessary and ugly when you are spending your time spewing comments with those same traits.
        wendroid 17y ago
        I was a professional programmer in PHP for just under 10 years so I'm not just bandwagon jumping. I don't get paid by yahoo to post here so I'm free to be as sloppy as I like.
    - mootothemax 17y ago
      I could have been clearer with what I meant there, and I agree with you: it's not a problem specific to PHP, and in some ways it's unfair to label beginners' mistakes as problems in the first place. The point I wanted to emphasize is that by reading lists like these new users might think that this is a good way to write PHP, whereas I strongly disagree with this list existing in the first place. There's also the slightly selfish point of view of not wanting to have to clean up code like this should I come across it in future ;)
      - ddbb 17y ago
        I agree with you. But beginners need to learn from somewhere and most advanced programmers are busy at work and not writing articles :) Plus, did you ever read a PHP book? Most of them give bad examples and bad code practices too... I just read one that said to disable all apache logging (including error logging) for performance reasons.
  - encoderer 17y ago
    PHP's use of variable variable's is certainly easy to abuse, but in the right hands it creates a very elegant solution. If we took away every tool that can be misapplied and misused, we wouldn't have very many left. This is a crude example, but imagine, eg, loading up a data model. Maybe it is lazy loaded, maybe cached, whatever, but you have an array with keys that match properties. You could use a giant switch, a slew of if(isset()) code, or you could do something like this: public function __construct($data = array()) { foreach($data as $k => $v) $this->{$k} = $v; } Obviously, this is POC stuff, in reality you'd want to put a 1-line check in there to ensure the $k is a valid property in that class. AFAIK, there's nothing you can do with variable variables that you can't do another way. But there are several things you can do much easier and more elegantly. I get your argument. Programmers all over the place inherit sucky code from newbie developers. But there is no valid argument, IMO, to a language eliminating features because they can be misapplied.
  - encoderer 17y ago
    Let me point out a small flaw in the way you parsed my comment. I didn't say this is a good list for new developers. I said this is a good list for developers new to PHP. I see a big difference there.
  - sethg 17y ago
    You’re right. Mark-Jason Dominus’s 1998 essay “Why it’s stupid to ‘use a variable as a variable name’” seems to be apropos here: http://perl.plover.com/varvarname.html http://perl.plover.com/varvarname.html
- pavel_lishin 17y ago
  ${‘a’ . ‘b’} = ‘c’; echo $ab; // it will outputs c I've seen people abuse that "feature" to write utterly unreadable messes of code that should have been covered in pasta sauce. Developers new to PHP should absolutely not be using this, not until they learn how to write clear, easy to read code.
lt 17y ago
Have you ever seen better code for swapping two variables’ values !? Actually yeah. Ways that people reading the code would recognize right away. I'm not sure if that's intuitive for someone who codes in PHP, but if it belongs in a "PHP Tricks" article then it doesn't sound like the best way to do it.
- RyanMcGreal 17y ago
  Python: >>> a = 'apple' >>> b = 'banana' >>> a, b = b, a
martinp 17y ago
2. You can check if a email is valid by the checkdnsrr() function. It checks the email’s host address if it’s a valid DNS record. Should this function really be used for email validation? 5. Easily unpack numeric arrays using the well-know function list <snip> Have you ever seen better code for swapping two variables’ values !? Yes, try Python: a, b = b, a
smanek 17y ago
As a first couple of notes: 1. You can gzip strings before storing them in a DB But many modern Databases/Filesystems have the built in ability to achieve the same effect - but faster and more transparently. 2. Verify an email’s host address is a valid DNS record. True, you can. But what's the point? I see two possibilities - either you want to guarantee an address is legit or you don't. If you want a guarantee this doesn't get you anything (you'll still have to send a confirmation email). If you don't care, then what's the point (someone has to type joe@aol.com instead of joe@klasjfklashf.com?). And (as a more minor concern) at sufficient scale, it could cause performance problems. I remember some webserver used to reverse-lookup IPs so it could log hostnames in its access log, and it was brought to its knees by even minimal levels of traffic).
- ErrantX 17y ago
  > then what's the point rudimentary "junk" detection. I've used it in the past as a basic scheme to reject certain types of bots on a PHPBB forum.
- dutchflyboy 17y ago
  1. I completely agree. 2. Well, there is a point, it blocks those people who just type anything in the registration forms. But I agree that it's too easy to trick. Performance shouldn't be a problem. Only registring users need to have their email addresses checked. In your example, every page load = a dns request, which isn't a great idea. As one registration = a dns request, this load should be quite easy to handle for the webserver.
- eli 17y ago
  Yes, it drives me nuts when people stress over picking the right regexp to "verify" email addresses. As if they're ever going to be able to detect that screw@you.com is not legit. The goal should just be to identify common typos (comma instead of dot). There's only one way to see if an email address is real.
  - cschneid 17y ago
    But there is great value in telling that new user "Hey this doesn't look like an email address, please check it before continuing". Then accept whatever they put in (because really, email addresses are stupidly complex).
raffi 17y ago
I'm a reasonably competent programmer by most standards and I was burned by PHP once. If you include a file with their include() function and have whitespace after the closing ?> tag in the file--PHP will throw an error. Except it gets better: whether this happens or not depends on a setting in php.ini (output buffering I think). This happens if you're trying to send header information from the parent file but include a file that outputs whitespace on accident. The output buffering delays sending the output (because it's buffered, duh :)) so the header info can be sent, hence no error. This is one of those things I didn't know and wish I did. http://stackoverflow.com/questions/1793482/php-error-cannot-modify-header-information-headers-already-sent http://stackoverflow.com/questions/1793482/php-error-cannot-... The work around: omit the closing ?> tag from included files.
- bendtheblock 17y ago
  The same occurs in Drupal template files (which are powered by PHPtemplate, by default anyway). Including the closing tag with whitespace after causes a white screen of death which can be infuriating to debug - unless you know this.
- randallsquared 17y ago
  The best way to handle this is not to even put a closing ?> unless you intend to have non-PHP in the file.
- dutchflyboy 17y ago
  That's one of the most irritating problems with PHP due to the impossibility to find the bug (well, it's a whitespace, it's not as if one could see it). On my server, including a file with a whitespace after the ?> actually made the server send the PHP source code as text, including the mysql passwords that were included in the file.
  - andrewvc 17y ago
    Ouch, I generally try to put password files in directories not even in www_root, that way if the web server config gets messed up this stuff isn't even possible.
deleted 17y ago
[deleted]
deleted 17y ago
[deleted]
RyanMcGreal 17y ago
>7. You can handle the situation when a class that doesn’t exist is instantiated I'm not a PHP programmer so maybe I just don't get it ... but why would you ever want to instantiate a class that doesn't exist?
- deleted 17y ago
  [deleted]
- pbhjpbhj 17y ago
  I could perhaps see it as a debugging tool, a way to catch the name and line number of a class typo?
- shaunxcode 17y ago
  This is actually how frameworks like Zend require_once the file which DOES contain the class definition (and thus the ugly class names i.e. Zend_Db_Table_Row etc. that correspond to the actual directory structure). With proper namespaces most of this should go away.
- Jach 17y ago
  Laziness. When your web app is class-driven and you generally have need of many different classes, it's annoying to have to include them every time you want them. (And a sin to include all of them when you won't need them.)

28 points by vladocar 17y ago

This is a good list for developers new to PHP. Most lists that target that group tend to have a lot of outdated, wrong information; optimizations that were important for PHP4 but irrelevant today. This one seems to skirt that. One change I would make is to use the very effective Filter Input library to check an email address before you check it's DNS record. It would prevent a costly DNS hit if the email address is just gibberish. Edit: For the criticism below (and unexplicable down-mods), take note that I didn't say this is a good list for new developers. I said this is a good list for developers new to PHP

mootothemax 17y ago
I disagree, I think this kind of list is another reason why new developers write poor PHP code. For example, as you highlight, there's no mention of checking to see if the string is an email address before taking the DNS hit. Then number 1: what's the point of having a long string stored in the database if it's compressed? Either put it there so you can search with it or store it on the local filesystem. 5. Why on earth should we be encouraging people to write code like this? 6. The same point, and even the list's author doesn't know what's going on here. He's using variable variables, e.g. $cow = "ermintrude"; $dog = "wuffles"; $animal = "cow"; echo $$animal; //outputs ermintrude echo ${"dog"}; //output wuffles As I say, new developers don't need these features and shouldn't be using them. For that matter, I don't think any developer should be using the features I mention above: am I wrong?
- ddbb 17y ago
  The reason they write poor code is because they are beginners and beginners always make mistakes, use functions incorrectly, etc. In any language they code, not just PHP. PHP is often more visible because it is more used and easier to write... But if PHP wasn't that popular, we would see the same issue with Perl, Python, etc.
  - wendroid 17y ago
    PHP encourages shitty code because it is already shitty code in a shitty language. It's the broken windows effect. All you need to know is from Rasmus himself "There are people who actually like programming. I don't understand why they like programming." see also his other gems http://en.wikiquote.org/wiki/Rasmus_Lerdorf http://en.wikiquote.org/wiki/Rasmus_Lerdorf
    - encoderer 17y ago
      The broken window effect? Really? PHP is far from my favorite language but "language wars" and comments like yours that lead to them are 100% brain dead. Void of original thought. I see a little irony in people like you cursing PHP as unnecessary and ugly when you are spending your time spewing comments with those same traits.
      - wendroid 17y ago
        I was a professional programmer in PHP for just under 10 years so I'm not just bandwagon jumping. I don't get paid by yahoo to post here so I'm free to be as sloppy as I like.
  - mootothemax 17y ago
    I could have been clearer with what I meant there, and I agree with you: it's not a problem specific to PHP, and in some ways it's unfair to label beginners' mistakes as problems in the first place. The point I wanted to emphasize is that by reading lists like these new users might think that this is a good way to write PHP, whereas I strongly disagree with this list existing in the first place. There's also the slightly selfish point of view of not wanting to have to clean up code like this should I come across it in future ;)
    - ddbb 17y ago
      I agree with you. But beginners need to learn from somewhere and most advanced programmers are busy at work and not writing articles :) Plus, did you ever read a PHP book? Most of them give bad examples and bad code practices too... I just read one that said to disable all apache logging (including error logging) for performance reasons.
- encoderer 17y ago
  PHP's use of variable variable's is certainly easy to abuse, but in the right hands it creates a very elegant solution. If we took away every tool that can be misapplied and misused, we wouldn't have very many left. This is a crude example, but imagine, eg, loading up a data model. Maybe it is lazy loaded, maybe cached, whatever, but you have an array with keys that match properties. You could use a giant switch, a slew of if(isset()) code, or you could do something like this: public function __construct($data = array()) { foreach($data as $k => $v) $this->{$k} = $v; } Obviously, this is POC stuff, in reality you'd want to put a 1-line check in there to ensure the $k is a valid property in that class. AFAIK, there's nothing you can do with variable variables that you can't do another way. But there are several things you can do much easier and more elegantly. I get your argument. Programmers all over the place inherit sucky code from newbie developers. But there is no valid argument, IMO, to a language eliminating features because they can be misapplied.
- encoderer 17y ago
  Let me point out a small flaw in the way you parsed my comment. I didn't say this is a good list for new developers. I said this is a good list for developers new to PHP. I see a big difference there.
- sethg 17y ago
  You’re right. Mark-Jason Dominus’s 1998 essay “Why it’s stupid to ‘use a variable as a variable name’” seems to be apropos here: http://perl.plover.com/varvarname.html http://perl.plover.com/varvarname.html
pavel_lishin 17y ago
${‘a’ . ‘b’} = ‘c’; echo $ab; // it will outputs c I've seen people abuse that "feature" to write utterly unreadable messes of code that should have been covered in pasta sauce. Developers new to PHP should absolutely not be using this, not until they learn how to write clear, easy to read code.

lt 17y ago

Have you ever seen better code for swapping two variables’ values !? Actually yeah. Ways that people reading the code would recognize right away. I'm not sure if that's intuitive for someone who codes in PHP, but if it belongs in a "PHP Tricks" article then it doesn't sound like the best way to do it.

RyanMcGreal 17y ago
Python: >>> a = 'apple' >>> b = 'banana' >>> a, b = b, a

martinp 17y ago

2. You can check if a email is valid by the checkdnsrr() function. It checks the email’s host address if it’s a valid DNS record. Should this function really be used for email validation? 5. Easily unpack numeric arrays using the well-know function list <snip> Have you ever seen better code for swapping two variables’ values !? Yes, try Python: a, b = b, a

smanek 17y ago

As a first couple of notes: 1. You can gzip strings before storing them in a DB But many modern Databases/Filesystems have the built in ability to achieve the same effect - but faster and more transparently. 2. Verify an email’s host address is a valid DNS record. True, you can. But what's the point? I see two possibilities - either you want to guarantee an address is legit or you don't. If you want a guarantee this doesn't get you anything (you'll still have to send a confirmation email). If you don't care, then what's the point (someone has to type joe@aol.com instead of joe@klasjfklashf.com?). And (as a more minor concern) at sufficient scale, it could cause performance problems. I remember some webserver used to reverse-lookup IPs so it could log hostnames in its access log, and it was brought to its knees by even minimal levels of traffic).

ErrantX 17y ago
> then what's the point rudimentary "junk" detection. I've used it in the past as a basic scheme to reject certain types of bots on a PHPBB forum.
dutchflyboy 17y ago
1. I completely agree. 2. Well, there is a point, it blocks those people who just type anything in the registration forms. But I agree that it's too easy to trick. Performance shouldn't be a problem. Only registring users need to have their email addresses checked. In your example, every page load = a dns request, which isn't a great idea. As one registration = a dns request, this load should be quite easy to handle for the webserver.
eli 17y ago
Yes, it drives me nuts when people stress over picking the right regexp to "verify" email addresses. As if they're ever going to be able to detect that screw@you.com is not legit. The goal should just be to identify common typos (comma instead of dot). There's only one way to see if an email address is real.
- cschneid 17y ago
  But there is great value in telling that new user "Hey this doesn't look like an email address, please check it before continuing". Then accept whatever they put in (because really, email addresses are stupidly complex).

raffi 17y ago

I'm a reasonably competent programmer by most standards and I was burned by PHP once. If you include a file with their include() function and have whitespace after the closing ?> tag in the file--PHP will throw an error. Except it gets better: whether this happens or not depends on a setting in php.ini (output buffering I think). This happens if you're trying to send header information from the parent file but include a file that outputs whitespace on accident. The output buffering delays sending the output (because it's buffered, duh :)) so the header info can be sent, hence no error. This is one of those things I didn't know and wish I did. http://stackoverflow.com/questions/1793482/php-error-cannot-modify-header-information-headers-already-sent http://stackoverflow.com/questions/1793482/php-error-cannot-... The work around: omit the closing ?> tag from included files.

bendtheblock 17y ago
The same occurs in Drupal template files (which are powered by PHPtemplate, by default anyway). Including the closing tag with whitespace after causes a white screen of death which can be infuriating to debug - unless you know this.
randallsquared 17y ago
The best way to handle this is not to even put a closing ?> unless you intend to have non-PHP in the file.
dutchflyboy 17y ago
That's one of the most irritating problems with PHP due to the impossibility to find the bug (well, it's a whitespace, it's not as if one could see it). On my server, including a file with a whitespace after the ?> actually made the server send the PHP source code as text, including the mysql passwords that were included in the file.
- andrewvc 17y ago
  Ouch, I generally try to put password files in directories not even in www_root, that way if the web server config gets messed up this stuff isn't even possible.

deleted 17y ago

[deleted]

deleted 17y ago

[deleted]

RyanMcGreal 17y ago

>7. You can handle the situation when a class that doesn’t exist is instantiated I'm not a PHP programmer so maybe I just don't get it ... but why would you ever want to instantiate a class that doesn't exist?

deleted 17y ago
[deleted]
pbhjpbhj 17y ago
I could perhaps see it as a debugging tool, a way to catch the name and line number of a class typo?
shaunxcode 17y ago
This is actually how frameworks like Zend require_once the file which DOES contain the class definition (and thus the ugly class names i.e. Zend_Db_Table_Row etc. that correspond to the actual directory structure). With proper namespaces most of this should go away.
Jach 17y ago
Laziness. When your web app is class-driven and you generally have need of many different classes, it's annoying to have to include them every time you want them. (And a sin to include all of them when you won't need them.)