4 ms·

As a person with more of an ops background can someone explain to me why / when PHP might be a viable language? My experience with hosting PHP apps has historic

by mrmondo 11y ago

As a person with more of an ops background can someone explain to me why / when PHP might be a viable language? My experience with hosting PHP apps has historicity been one of fending off security issues and I think that often in the past PHP was often a language for designers that didn't have experienced programming skills, it feels like designers have now shifted to using Node for this?

ianhawes 11y ago
It depends on whats being hosted. If you're dealing with legacy apps that were built in the PHP 5.2 or even PHP 4 days, be afraid. Be very afraid. If you're dealing with more mainstream PHP apps like WordPress or Magento, its important to stay up on the core updates but also monitor the plugins and templates being installed. The majority of the attack surface on those apps is in the plugins because they're almost never audited. As for modern customer apps, written in frameworks like Laravel or Symfony, you're usually fine. Those frameworks are on par with Django and Rails in being very hard to shoot yourself with.
- castell 11y ago
  > legacy apps that were built in the PHP 5.2 or even PHP 4 days, be afraid. Be very afraid BS. Most PHP4 code runs just fine, as do PHP5 code. Almost no one used object oriented code in PHP4 days (it was slow!), so the incompatible changes aren't a problem. And all you need to do is to search and replace some function names like mysql_* to mysqli_*. Most old code bases from PHP4 days also didn't rely on frameworks at all and were completely written from scratch or copy&pasted together - actually an advantage in this case. Upgrading an old Python or Ruby code from 1.x/2.x days is a lot of more work (as it always includes upgrading to a recent framework version) than upgrading from PHP4 or PHP5 to PHP7.
gkwelding 11y ago
"My experience with hosting PHP apps has historicity been one of fending off security issues" Unfortunately PHP seems to have this reputation. It's not so much the language that is the problem but the people using it. PHP typically had such a low bar to entry that literally anyone could pick it up and do anything and everything with it. And quite frankly there were (and still are) a lot of beginner tutorials out there encouraging people to do very stupid insecure stuff. It now seems to be an image that stuck. If you take a look at the OWASP Top 10, and any big data breaches recently, they are all caused by human error. SQL injection being the major culprit.
- ams6110 11y ago
  fending off security issues This is my general experience with all platforms and operating systems. You have to keep up to date. PHP was early on the web scene, and like ASP it encouraged a lot of bad practices (like concatenating user input into SQL strings) before people knew better. These days, in the hands of a competent developer, it's no worse than any other mainstream stack as far as security goes.
- acdha 11y ago
  That explanation is technically true but it's like blaming human error for factory workers being injured by a machine without safety guards. Since it happens so frequently you have to ask how the language could change to make it less common. Most of it comes down to being developed ad-hoc with convenience for solving a simple problem right now as the main driving force. Remember register globals? That was a minor convenience which took ages and millions of exploits to be removed – I remember lobbying for that in the late 90s. Similarly, you mentioned SQL injection. Unlikely as this may seem now, there was a time when things like prepared statements were an exotic new feature with limited library support and a certain school of programmer thought they were probably too slow. The docs and most tutorials didn't mention things like validation or escaping prominently so most PHP developers were trained to slop everything into strings. When PDO came along, this persisted for too long as well and even after they started recommending placeholders you didn't get something like all of the mysql functions saying “Don't use this, it's unsafe”. I've heard that this has improved but it's been years since I needed to look. Similarly, look at the lax attitudes toward error handling — errors are ignored by default, database errors or warnings have to be explicitly requested, etc. That's “easier”, saving whole seconds of learning at the expense of millions of successful exploits and hours spent debugging.
- marcosdumay 11y ago
  Not the language? PHP is the only lasting language where making code that allows SQL injection is easier than code that forbids it. PHP includes all the worst practices you'll find on any languages. Javascript has the eval problem - PHP has it too; Perl have the too fluid type system where you can't specify anything - PHP too, except that it lacks Perl's tainted mode; Asp made it easier to create code subject to XSS than code that isn't and is subject to directory traversal - guess what, PHP copied it... and the list goes on and on. This release fixes still some more problems, but PHP will never become a good language.
gaius 11y ago
language for designers that didn't have experienced programming skills A history lesson: PHP was originally known as PHP/FI which meant "personal home page form interpreter". That people started using it for "real work" took everyone by surprise, including the author! http://php.net/manual/phpfi2.php#history http://php.net/manual/phpfi2.php#history
Joeri 11y ago
PHP historically had the advantage of being really easy to program for with limited knowledge, while still being powerful enough to let you evolve from small hobby projects to big enterprise web apps. Python and Ruby became popular for similar reasons, but they were harder to host, so PHP kept an edge. I would say that today go and node.js have similar programmability advantages, as well as eclipsing PHP performance-wise, but as long as they're not universally available from shared web hosts PHP will have a niche.

by mrmondo 11y ago

ianhawes 11y ago

It depends on whats being hosted. If you're dealing with legacy apps that were built in the PHP 5.2 or even PHP 4 days, be afraid. Be very afraid. If you're dealing with more mainstream PHP apps like WordPress or Magento, its important to stay up on the core updates but also monitor the plugins and templates being installed. The majority of the attack surface on those apps is in the plugins because they're almost never audited. As for modern customer apps, written in frameworks like Laravel or Symfony, you're usually fine. Those frameworks are on par with Django and Rails in being very hard to shoot yourself with.

castell 11y ago
> legacy apps that were built in the PHP 5.2 or even PHP 4 days, be afraid. Be very afraid BS. Most PHP4 code runs just fine, as do PHP5 code. Almost no one used object oriented code in PHP4 days (it was slow!), so the incompatible changes aren't a problem. And all you need to do is to search and replace some function names like mysql_* to mysqli_*. Most old code bases from PHP4 days also didn't rely on frameworks at all and were completely written from scratch or copy&pasted together - actually an advantage in this case. Upgrading an old Python or Ruby code from 1.x/2.x days is a lot of more work (as it always includes upgrading to a recent framework version) than upgrading from PHP4 or PHP5 to PHP7.

gkwelding 11y ago

"My experience with hosting PHP apps has historicity been one of fending off security issues" Unfortunately PHP seems to have this reputation. It's not so much the language that is the problem but the people using it. PHP typically had such a low bar to entry that literally anyone could pick it up and do anything and everything with it. And quite frankly there were (and still are) a lot of beginner tutorials out there encouraging people to do very stupid insecure stuff. It now seems to be an image that stuck. If you take a look at the OWASP Top 10, and any big data breaches recently, they are all caused by human error. SQL injection being the major culprit.

ams6110 11y ago
fending off security issues This is my general experience with all platforms and operating systems. You have to keep up to date. PHP was early on the web scene, and like ASP it encouraged a lot of bad practices (like concatenating user input into SQL strings) before people knew better. These days, in the hands of a competent developer, it's no worse than any other mainstream stack as far as security goes.
acdha 11y ago
That explanation is technically true but it's like blaming human error for factory workers being injured by a machine without safety guards. Since it happens so frequently you have to ask how the language could change to make it less common. Most of it comes down to being developed ad-hoc with convenience for solving a simple problem right now as the main driving force. Remember register globals? That was a minor convenience which took ages and millions of exploits to be removed – I remember lobbying for that in the late 90s. Similarly, you mentioned SQL injection. Unlikely as this may seem now, there was a time when things like prepared statements were an exotic new feature with limited library support and a certain school of programmer thought they were probably too slow. The docs and most tutorials didn't mention things like validation or escaping prominently so most PHP developers were trained to slop everything into strings. When PDO came along, this persisted for too long as well and even after they started recommending placeholders you didn't get something like all of the mysql functions saying “Don't use this, it's unsafe”. I've heard that this has improved but it's been years since I needed to look. Similarly, look at the lax attitudes toward error handling — errors are ignored by default, database errors or warnings have to be explicitly requested, etc. That's “easier”, saving whole seconds of learning at the expense of millions of successful exploits and hours spent debugging.
marcosdumay 11y ago
Not the language? PHP is the only lasting language where making code that allows SQL injection is easier than code that forbids it. PHP includes all the worst practices you'll find on any languages. Javascript has the eval problem - PHP has it too; Perl have the too fluid type system where you can't specify anything - PHP too, except that it lacks Perl's tainted mode; Asp made it easier to create code subject to XSS than code that isn't and is subject to directory traversal - guess what, PHP copied it... and the list goes on and on. This release fixes still some more problems, but PHP will never become a good language.

gaius 11y ago

language for designers that didn't have experienced programming skills A history lesson: PHP was originally known as PHP/FI which meant "personal home page form interpreter". That people started using it for "real work" took everyone by surprise, including the author! http://php.net/manual/phpfi2.php#history http://php.net/manual/phpfi2.php#history

Joeri 11y ago

PHP historically had the advantage of being really easy to program for with limited knowledge, while still being powerful enough to let you evolve from small hobby projects to big enterprise web apps. Python and Ruby became popular for similar reasons, but they were harder to host, so PHP kept an edge. I would say that today go and node.js have similar programmability advantages, as well as eclipsing PHP performance-wise, but as long as they're not universally available from shared web hosts PHP will have a niche.