7 ms·
Given how much has been deprecated/removed since 5.2, would you care to list some that remain?
by stephenr 9y ago
Given how much has been deprecated/removed since 5.2, would you care to list some that remain?
- smt88 9y agoTruthiness (e.g. 0 == false, '0' == true, 'false' == true, etc.) makes it easier to introduce bugs. There's a lot of discipline/linting still required in PHP, whereas other languages won't even compile if you do something risky. I wouldn't take that criticism too personally. People also argue that C/C++ can't ever be secure due to the ease of programmer mistakes.
- CiPHPerCoder 9y ago> Truthiness (e.g. 0 == false, '0' == true, 'false' == true, etc.) makes it easier to introduce bugs. Use === instead; except for cryptography, where you want hash_equals(). > There's a lot of discipline/linting still required in PHP, whereas other languages won't even compile if you do something risky. And/or just use scalar type declarations: https://3v4l.org/SJKe1 https://3v4l.org/SJKe1
- bpicolo 9y agoScalar type declarations don't help detect usage of undefined variables, as an example. Phan is the only tool I've found that does, but it's a very heavyweight thing, given how necessary it is to prevent undefined variable exceptions.
- CiPHPerCoder 9y agoThat's a separate concern from truthiness. And if you aren't using nullable types (a 7.1+ feature), passing NULL gives you a TypeError. :)
- muglug 9y agoI wrote a similar tool that's slightly less heavyweight (doesn't rely on a separate extension): https://getpsalm.org/ https://getpsalm.org/
- CiPHPerCoder 9y agoYes, Psalm is great. We use it in a lot of our projects, and in the future will be using it in all of them. We absolutely love it. (It's on my "to blog about" queue.)
- bpicolo 9y agoI'm going to be trying it out. Thanks. The more lints the better when dealing with legacy monoliths!
- smt88 9y agoI agree that there are safe (or safer) ways to do things in PHP, but in business settings, it's often hard to enforce such things. "Discipline" is very hard to maintain consistently across people with different backgrounds. I've actually gone as far as rejecting commits that failed the linter and style checker, but that only works for code bases I have control over. It doesn't apply to the libs. I now prefer languages where the entire ecosystem is passing strict compilation requirements.
- masklinn 9y ago> Truthiness (e.g. 0 == false, '0' == true, 'false' == true, etc.) That's not truthiness, that's implicit coercions. Truthiness is specific to boolean contexts (if, while, explicit conversion to boolean).
- smt88 9y agoI guess that's an interesting nitpick, but I was referring to truthiness. I chose what I now see was a confusing way to express it as text. What I really meant was that you have some $variable, and you test it in an if, while, etc. context. If the value is 0, it's false. But if you didn't realize you got a string from somewhere, it might be true. Unless it's an empty string? (I can't even remember.) None of this changes the initial point, which is that writing "good" PHP requires enormous amounts of discipline, and that still doesn't address the security issues with PHP itself. I remember when the developer of Suhosin basically quit PHP and said he couldn't deal with the way its maintainers treated security issues.
- bpicolo 9y agoSilent failures for indexing on primitives? $foo = 1; $foo[1]; // no problems $foo = true; $foo[0]; // seems good to php PHP's choose-your-own-error-adventure with all errors on (which is the only good choice) is pretty silly. arrays become somewhat unwieldy because the core libs for arrays are deficient, missing things like a get_default($array, $key, $default). The array core lib in general is troublesome to understand/intuit different pieces for, probably because mashing hash types and lists together leads to all sorts of ambiguity (like ambiguous json decoding/encoding). Want some subset of an array? Sure, that's the super-intuitive `array_intersect_key($array, array_flip($keys));` The core array type is really a frustrating experience in PHP, and interop deficiencies with ArrayObject make it unusable as an alternative.
- stephenr 9y ago> get_default($array, $key, $default). $array[$key] ?? $default im still not sure what any of this has to do with "the only secure php is no php"?
- bpicolo 9y agoWith all notices on accessing an undefined index is a notice, which you're doing with that syntax, no?
- CiPHPerCoder 9y agoNope. https://3v4l.org/J45qU https://3v4l.org/J45qU
- bpicolo 9y agoAhh this is new in 7.0. Good to know, hadn't seen that. Still of the opinion that the array builtins are a hassle. =]
- deleted 9y ago[deleted]
- 9y ago
- TylerE 9y agoThat will be a valid rebuttal when ten million shitty shared hosts are no longer on 5.x - and probably an out of date 5.x at that.
- function_seven 9y agoThen you should rephrase your statement. Something like: The only secure PHP is version x.x or newer.
- TylerE 9y agoI do not believe there to be an $x where that statement is true.
- CiPHPerCoder 9y agoThen your previous statement about PHP versions is irrelevant, and you should answer the question you were asked. To wit: > Given how much has been deprecated/removed since 5.2, would you care to list some that remain? For the version coming out at the end of the year, what is still insecure that leads you to believe "there is not an $x where that a statement is true"?
- TylerE 9y agoI don't see what's so hard to understand. 7.x is better than 5.x but not GOOD ENOUGH.
- CiPHPerCoder 9y ago> 7.x is better than 5.x but not GOOD ENOUGH. What would make it good enough? Be specific.
- TylerE 9y agoNot being PHP. PHP is brain-damaged. With so many much-better languages there is zero reason to use PHP, or spend effort improving PHP.