3 ms·

Presumably, this guy's never seen $_SESSION hell: enormous amounts of state stashed in a single super-global associative array that persists between sessions [1

Presumably, this guy's never seen $_SESSION hell: enormous amounts of state stashed in a single super-global associative array that persists between sessions [1]. In addition to $_SESSION hell, lots of custom PHP applications end up with extremely complex and convoluted MySQL tables dedicated to storing what would typically be global application state. Both of these can lead to difficult-to-debug performance issues, race conditions, and especially security vulnerabilities. Global state is going to happen, so languages/libraries should provide mechanisms that make it easy to state and enforce strict invariants on reads and writes to global state. [1] http://php.net/manual/en/reserved.variables.session.php http://php.net/manual/en/reserved.variables.session.php

fgheorghe 8y ago
Thats pretty much a bad practice well documented accross various php tutorials and books. But many php developers have no understanding of programming so they stash everything in that _SESSION superglobal or do other scary things.
- throwawayjava 8y ago
  Global state in general is bad practice well documented across tutorials and books about programming. Article's argument is that PHP avoids global state, but _SESSION hell and "MySQL table as global state" patterns demonstrate that programmers will always find a way to shoot themselves in the foot with global state :) Also, IME even good PHP programmers suffer from the "MySQL-table-as-global-runtime-state" syndrome. And it's at least as bug-prone as storing global state in an ADT.
codedokode 8y ago
I don't like sessions in PHP: most times the problem can be solved without them. But sessions are available in other languages as well: - https://docs.djangoproject.com/en/2.1/topics/http/sessions/ https://docs.djangoproject.com/en/2.1/topics/http/sessions/ - https://guides.rubyonrails.org/security.html#sessions https://guides.rubyonrails.org/security.html#sessions - https://www.npmjs.com/package/express-session https://www.npmjs.com/package/express-session

fgheorghe 8y ago

Thats pretty much a bad practice well documented accross various php tutorials and books. But many php developers have no understanding of programming so they stash everything in that _SESSION superglobal or do other scary things.

throwawayjava 8y ago
Global state in general is bad practice well documented across tutorials and books about programming. Article's argument is that PHP avoids global state, but _SESSION hell and "MySQL table as global state" patterns demonstrate that programmers will always find a way to shoot themselves in the foot with global state :) Also, IME even good PHP programmers suffer from the "MySQL-table-as-global-runtime-state" syndrome. And it's at least as bug-prone as storing global state in an ADT.

codedokode 8y ago

I don't like sessions in PHP: most times the problem can be solved without them. But sessions are available in other languages as well: - https://docs.djangoproject.com/en/2.1/topics/http/sessions/ https://docs.djangoproject.com/en/2.1/topics/http/sessions/ - https://guides.rubyonrails.org/security.html#sessions https://guides.rubyonrails.org/security.html#sessions - https://www.npmjs.com/package/express-session https://www.npmjs.com/package/express-session