3 ms·

PHP has had the PDO extension since version 5.1, released in 2005. Blaming the language for SQL injection hasn't been a valid excuse for over a decade. The onl

PHP has had the PDO extension since version 5.1, released in 2005. Blaming the language for SQL injection hasn't been a valid excuse for over a decade. The only problem with PHP is that it has the easiest barrier to entry - or perhaps more accurately, no barrier to entry whatsoever. The kind of developer you're describing would never have written a line of code if PHP didn't exist. Python, Perl, Ruby, and Java just wouldn't have been an entry point into programming for them. Node is different, as like PHP, it is accessible to frontend developers who want to branch off into backend as an "addon" rather than as a primary endeavor.

astrodust 10y ago
PHP the language and PHP the ecosystem are different but inseparable. Although technically PHP has had PDO since 5.1 the community is extremely, frustratingly slow to adopt new things. I remember considerable resistance on the part of the community to the very idea of object-oriented problem, something that massively limits uptake on things like PDO and is the driving reason behind mysqli having a bizarre mixed mode, OO or procedural based on preference. Likewise, PHP tutorials, references, and guides kept pushing the absolutely garbage mysql_query interface on people. I don't know how many books published post-PDO insisted on using this approach because it was "easier" or whatever, and some books don't even touch on SQL injection bugs, it's like they don't exist, even while the examples lack escaping of any sort and would crash on certain kinds of input. > The kind of developer you're describing would never have written a line of code if PHP didn't exist. Bullshit. These are people that want to learn to program, and as they look around they see PHP is popular, it's easy to get support for, and hosting it is easy. It's got a lot of positive points. I've seen people with zero technical experience pick up Ruby and build a Rails app inside of months, they get productive very quickly. Same could be said for Node with the right mentoring, though the async stuff is a little harder to get lined up. Client-side apps aren't all that bad, though. PHP has a lot of good things going for it, but too much of the community is absolutely in the dark about it. There's almost zero outreach being done.
- chiefalchemist 10y ago
  It sounds like a case of more is less. That is, there's a tipping point - that's not really PHP's fault - where quantity of participants makes quality close to impossible. Yes, there is quality PHP usage but it's rare, if only because the masses create so much noise. Look at WordPress for example.
  - developer2 10y ago
    WordPress is one of the worst examples you could ever point a new PHP developer to. A friend once pointed me to Automattic as an entity to work for (on WordPress) as a nomad developer. I took one look at wp-login.php in the root directory and after 30 seconds of reading, knew I could never take the people that work on that codebase seriously. The first line of the file is "require( dirname(__FILE__) . '/wp-load.php' );". a) "require" is a statement, not a function; it should not have parentheses around it at all. b) Oh. my. god. Their coding standard require spaces inside parentheses; I have never seen this in any language, even from legacy codebases or esoteric developers - it's incomprehensible that some senior developer managed to enforce this on the entire company. c) Oh, mixed PHP class and HTML; a 1000 line file for a login script. RUN! SERIOUSLY, RUN AWAY! After this many years, backwards compatibility is not an excuse. WordPress should be avoided at all costs, unless it is the only way you believe you can build and sustain your business. If you have the choice to take any other avenue, take it. The developers working there have no clue, and/or are content with a status quo that is 20 years behind acceptable standards.
    - chiefalchemist 10y ago
      To be clear, I wasn't saying WordPress was a positive example. In fact, as you pointed out, quite the opposite. It's been drinking its own Kool Aid for so long that the nOObs don't dare ask questions, and The Elites are too comfortable to progress. Yeah. You're right. Ugly.

astrodust 10y ago

PHP the language and PHP the ecosystem are different but inseparable. Although technically PHP has had PDO since 5.1 the community is extremely, frustratingly slow to adopt new things. I remember considerable resistance on the part of the community to the very idea of object-oriented problem, something that massively limits uptake on things like PDO and is the driving reason behind mysqli having a bizarre mixed mode, OO or procedural based on preference. Likewise, PHP tutorials, references, and guides kept pushing the absolutely garbage mysql_query interface on people. I don't know how many books published post-PDO insisted on using this approach because it was "easier" or whatever, and some books don't even touch on SQL injection bugs, it's like they don't exist, even while the examples lack escaping of any sort and would crash on certain kinds of input. > The kind of developer you're describing would never have written a line of code if PHP didn't exist. Bullshit. These are people that want to learn to program, and as they look around they see PHP is popular, it's easy to get support for, and hosting it is easy. It's got a lot of positive points. I've seen people with zero technical experience pick up Ruby and build a Rails app inside of months, they get productive very quickly. Same could be said for Node with the right mentoring, though the async stuff is a little harder to get lined up. Client-side apps aren't all that bad, though. PHP has a lot of good things going for it, but too much of the community is absolutely in the dark about it. There's almost zero outreach being done.

chiefalchemist 10y ago
It sounds like a case of more is less. That is, there's a tipping point - that's not really PHP's fault - where quantity of participants makes quality close to impossible. Yes, there is quality PHP usage but it's rare, if only because the masses create so much noise. Look at WordPress for example.
- developer2 10y ago
  WordPress is one of the worst examples you could ever point a new PHP developer to. A friend once pointed me to Automattic as an entity to work for (on WordPress) as a nomad developer. I took one look at wp-login.php in the root directory and after 30 seconds of reading, knew I could never take the people that work on that codebase seriously. The first line of the file is "require( dirname(__FILE__) . '/wp-load.php' );". a) "require" is a statement, not a function; it should not have parentheses around it at all. b) Oh. my. god. Their coding standard require spaces inside parentheses; I have never seen this in any language, even from legacy codebases or esoteric developers - it's incomprehensible that some senior developer managed to enforce this on the entire company. c) Oh, mixed PHP class and HTML; a 1000 line file for a login script. RUN! SERIOUSLY, RUN AWAY! After this many years, backwards compatibility is not an excuse. WordPress should be avoided at all costs, unless it is the only way you believe you can build and sustain your business. If you have the choice to take any other avenue, take it. The developers working there have no clue, and/or are content with a status quo that is 20 years behind acceptable standards.
  - chiefalchemist 10y ago
    To be clear, I wasn't saying WordPress was a positive example. In fact, as you pointed out, quite the opposite. It's been drinking its own Kool Aid for so long that the nOObs don't dare ask questions, and The Elites are too comfortable to progress. Yeah. You're right. Ugly.