5 ms·

I almost wrote a similar comment, but I figured I would be downvoted. I realize it sounds cynical, but why should this effort be made for PHP? I loved PHP back

I almost wrote a similar comment, but I figured I would be downvoted. I realize it sounds cynical, but why should this effort be made for PHP? I loved PHP back in the year 2000, and at that time it had advantages that no other language had, but those days are long gone. There are many better languages now. I wrote about this in my essay "PHP is obsolete" and there was a fairly good conversation about that essay on Hacker News: https://news.ycombinator.com/item?id=9598309 https://news.ycombinator.com/item?id=9598309

CiPHPerCoder 9y ago
> but why should this effort be made for PHP? See https://w3techs.com/technologies/overview/programming_language/all https://w3techs.com/technologies/overview/programming_langua... Anyone who wants a more secure Internet must necessarily be interested in improving the security of PHP.
- code_duck 9y ago
  The figures on that page don’t mean that 83% of developers use PHP... Just that some things written in PHP are very popular. I’m sure that most of that figure is packages like WordPress.
  - CiPHPerCoder 9y ago
    Most of the Internet (5 out of 6 websites) is powered by PHP. This is true despite people saying "don't use PHP". I didn't imply that 83% of developers use PHP. I'm sorry if anyone read it that way. I'm zeroed-in on the "what powers the Internet" statistic.
tyingq 9y ago
It is still popular with newcomers, people that don't come from a structured CS background, etc. Because the barrier to entry is just so low. Meaning, it's a built in, working option on hosting providers, deceptively simple in the beginning, etc. Also, PHP still dominates the "host it yourself e-commerce" space, because of Magento, Opencart, and PrestaShop. Oh, and WordPress...it's some insane percentage of all sites. And lousy plugins are everywhere. We could ignore that crowd, but guiding them down the right path is better for everyone. Edit: I'm also not convinced that node.js, which is gaining ground with the same crowd, doesn't have similar issues. Footguns aren't unique to PHP.
- duskwuff 9y ago
  The availability on hosting providers is a HUGE deal. Sure, you can write an application in Python, or Node, or Java, or whatever else is theoretically better... but good luck finding somewhere to host it that's cheap and doesn't require you to do all the sysadmin work yourself (i.e, not a VPS). PHP may not be the best of all possible languages, but it's by far the most widely available.
  - tyingq 9y ago
    I agree. And, as mentioned, these hosting providers will likely make node.js just as simple soon, and node will replace php as the whipping boy for flippant remarks. What's old is new again. This is more about providing newbies with good advice than it is about PHP.
    - duskwuff 9y ago
      Honestly, I don't see that happening soon, if ever. PHP was easy for hosting providers because it was easy to plug in to existing virtual hosting support in Apache and FTP servers. Node is more complicated; there's no obvious "right" way to handle many Node apps running on a single shared server.
      - tyingq 9y ago
        There were several ways for PHP too, and still are, FWIW. The shared hosting providers eventually settled on the best compromise of price/performance/security. What they provide now is better and more scalable than old school CGI. Most of the shared hosts are using LightSpeed[1] as it squeezes as much as possible out of PHP in a shared environment. That vendor, and their low end shared host customers, aren't dumb. They will respond to market changes and make node.js a 1st class support item when it is clear that's where the money is. [1]https://www.litespeedtech.com https://www.litespeedtech.com
corobo 9y ago
> why should this effort be made for PHP Because people get into programming via PHP via writing extensions for popular PHP software (WordPress) because that's what they can get paid to do as an entry level dev. It would be prudent to have them get into it in a way that doesn't cause exploits. Sure everyone and their dog may one day get into programming via Javascript via Ghost or something else along that line, but that's just not how it is right now. How it is right now is people writing HTML forms that post into raw SQL queries - you can make rookie mistakes like that in any language, no matter which one happens to be the top dog of the moment. I also have to note that on a skim a lot of the comments you linked to can be distilled to "No it isn't"
open-source-ux 9y ago
For web development, PHP still has a key advantage that no other language can match: ease of deployment. Many developers woefully underestimate how important this is, particularly if non-technical users need to self-host your software. Telling potential users to spin up a VPS or type some command line instructions to install code is too complicated for many users, even though it may seem trivially easy to a developer.
- kbenson 9y ago
  Actually, I think the current state of the art is significantly easier than PHP was, in that you just choose your langauge and the framework written in your language, start it and go to localhost and some port. It used to be that you had to have a web host, and then( sure you could just drop PHP in place, but you still needed that host. Setting anything up yourself required twiddling with Apache and mod_php (or using a distro that shipped with packages that enabled it by default). The whole "start up a little webserver in the same language" trend makes everything much* easier to develop. Where PHP still has an edge is deployment for non-development. If you just want to drop in some software and use it on the web (e.g. a bulletin board), PHP is still easier in many cases for novice users. But that's not development, it's just deployment. I would even hazard that correct deployment of that software in a secure way is made harder by PHP's ease of deployment, as you have to rely on permissions in lieu of separate locations that have no remote read access, as many frameworks implement.
  - fizdoonk 9y ago
    >sure you could just drop PHP in place, but you still needed that host. Setting anything up yourself required twiddling with Apache and mod_php (or using a distro that shipped with packages that enabled it by default). php has builtin webserver since 5.4. that's like 5-6 years ago
    - kbenson 9y ago
      If we're talking about the rise and dominance of PHP, we're talking about 10-15 years ago.
meritt 9y ago
> but why should this effort be made for PHP? Why not? There's a large and active community, both the core dev team actively improving it, and millions of programmers building applications. Just because you don't like something doesn't mean the rest of the world agrees with you.

CiPHPerCoder 9y ago

> but why should this effort be made for PHP? See https://w3techs.com/technologies/overview/programming_language/all https://w3techs.com/technologies/overview/programming_langua... Anyone who wants a more secure Internet must necessarily be interested in improving the security of PHP.

code_duck 9y ago
The figures on that page don’t mean that 83% of developers use PHP... Just that some things written in PHP are very popular. I’m sure that most of that figure is packages like WordPress.
- CiPHPerCoder 9y ago
  Most of the Internet (5 out of 6 websites) is powered by PHP. This is true despite people saying "don't use PHP". I didn't imply that 83% of developers use PHP. I'm sorry if anyone read it that way. I'm zeroed-in on the "what powers the Internet" statistic.

tyingq 9y ago

It is still popular with newcomers, people that don't come from a structured CS background, etc. Because the barrier to entry is just so low. Meaning, it's a built in, working option on hosting providers, deceptively simple in the beginning, etc. Also, PHP still dominates the "host it yourself e-commerce" space, because of Magento, Opencart, and PrestaShop. Oh, and WordPress...it's some insane percentage of all sites. And lousy plugins are everywhere. We could ignore that crowd, but guiding them down the right path is better for everyone. Edit: I'm also not convinced that node.js, which is gaining ground with the same crowd, doesn't have similar issues. Footguns aren't unique to PHP.

duskwuff 9y ago
The availability on hosting providers is a HUGE deal. Sure, you can write an application in Python, or Node, or Java, or whatever else is theoretically better... but good luck finding somewhere to host it that's cheap and doesn't require you to do all the sysadmin work yourself (i.e, not a VPS). PHP may not be the best of all possible languages, but it's by far the most widely available.
- tyingq 9y ago
  I agree. And, as mentioned, these hosting providers will likely make node.js just as simple soon, and node will replace php as the whipping boy for flippant remarks. What's old is new again. This is more about providing newbies with good advice than it is about PHP.
  - duskwuff 9y ago
    Honestly, I don't see that happening soon, if ever. PHP was easy for hosting providers because it was easy to plug in to existing virtual hosting support in Apache and FTP servers. Node is more complicated; there's no obvious "right" way to handle many Node apps running on a single shared server.
    - tyingq 9y ago
      There were several ways for PHP too, and still are, FWIW. The shared hosting providers eventually settled on the best compromise of price/performance/security. What they provide now is better and more scalable than old school CGI. Most of the shared hosts are using LightSpeed[1] as it squeezes as much as possible out of PHP in a shared environment. That vendor, and their low end shared host customers, aren't dumb. They will respond to market changes and make node.js a 1st class support item when it is clear that's where the money is. [1]https://www.litespeedtech.com https://www.litespeedtech.com

corobo 9y ago

> why should this effort be made for PHP Because people get into programming via PHP via writing extensions for popular PHP software (WordPress) because that's what they can get paid to do as an entry level dev. It would be prudent to have them get into it in a way that doesn't cause exploits. Sure everyone and their dog may one day get into programming via Javascript via Ghost or something else along that line, but that's just not how it is right now. How it is right now is people writing HTML forms that post into raw SQL queries - you can make rookie mistakes like that in any language, no matter which one happens to be the top dog of the moment. I also have to note that on a skim a lot of the comments you linked to can be distilled to "No it isn't"

open-source-ux 9y ago

For web development, PHP still has a key advantage that no other language can match: ease of deployment. Many developers woefully underestimate how important this is, particularly if non-technical users need to self-host your software. Telling potential users to spin up a VPS or type some command line instructions to install code is too complicated for many users, even though it may seem trivially easy to a developer.

kbenson 9y ago
Actually, I think the current state of the art is significantly easier than PHP was, in that you just choose your langauge and the framework written in your language, start it and go to localhost and some port. It used to be that you had to have a web host, and then( sure you could just drop PHP in place, but you still needed that host. Setting anything up yourself required twiddling with Apache and mod_php (or using a distro that shipped with packages that enabled it by default). The whole "start up a little webserver in the same language" trend makes everything much* easier to develop. Where PHP still has an edge is deployment for non-development. If you just want to drop in some software and use it on the web (e.g. a bulletin board), PHP is still easier in many cases for novice users. But that's not development, it's just deployment. I would even hazard that correct deployment of that software in a secure way is made harder by PHP's ease of deployment, as you have to rely on permissions in lieu of separate locations that have no remote read access, as many frameworks implement.
- fizdoonk 9y ago
  >sure you could just drop PHP in place, but you still needed that host. Setting anything up yourself required twiddling with Apache and mod_php (or using a distro that shipped with packages that enabled it by default). php has builtin webserver since 5.4. that's like 5-6 years ago
  - kbenson 9y ago
    If we're talking about the rise and dominance of PHP, we're talking about 10-15 years ago.

meritt 9y ago

> but why should this effort be made for PHP? Why not? There's a large and active community, both the core dev team actively improving it, and millions of programmers building applications. Just because you don't like something doesn't mean the rest of the world agrees with you.