5 ms·

javascript isn't even usable out-of-the-box without a few (hundreds) libraries to make it comfortable to use. I disagree, PHP is nothing like it, its standard

javascript isn't even usable out-of-the-box without a few (hundreds) libraries to make it comfortable to use. I disagree, PHP is nothing like it, its standard modules library is chock-full of stuff that is fast, useful and based on existing C/C++ libraries or standards. but sure if one wants want to classify incompetent developers in the PHP bucket, then everything is "the new PHP"

bradleyjg 8y ago
Fast and useful stuff like mysql_escape_string?
- krapp 8y ago
  That's been deprecated for years, removed from current PHP and was just a wrapper around an existing C library to begin with. If you want to blame the current language for its former vulnerabilities, fine, but comparing apples to apples would mean looking at all of the terrible ways in which javascript has been integrated into the browser and OS over the years, particularly with Internet Explorer. And I can guarantee you, from personal experience, that PHP is not the only language in which string concatenation with variables is the most common means of writing SQL queries.
  - bradleyjg 8y ago
    I’m not defending js. On the contrary the two languages are similar in that early on a lot of people had a negative first impression because of some mind bogglingly stupid decisions made by the initial implementators. This lead to feedback loops where those that were repulsed by those negative impressions moved on to other languages while those that didn’t care stuck around. In both cases that lead to cowboy cultures developing. It is true that in both cases, eventually top notch engineers got involved in the projects’ core and cleaned things up to the extent possible. But it’s a heck of a lot easier to improve a spec than a culture.
- buboard 8y ago
  Yet, this ancient library did not have serious issues. It was not deprecated because someone hacked it or it was even bad, but because it had not been maintained for many years. The reason was probably that it did not need maintainance, it just worked, but programmers often used it in the wrong way. In fact, the removal from PHP has caused some very small and old projects to break, and IMHO php should not have removed it, for the sake of compatibility. Also, it is much faster than the suggested alternative (pdo).
  - bradleyjg 8y ago
    It did have serious security issues. That’s why not long after there was another function added named mysql_real_escape_string.
    - duskwuff 8y ago
      No, that's not true. That function name was copied directly from the MySQL C API. It was not added by PHP. https://dev.mysql.com/doc/refman/5.5/en/mysql-real-escape-string.html https://dev.mysql.com/doc/refman/5.5/en/mysql-real-escape-st...
      - bradleyjg 8y ago
        “You can use this function safely with your MySQL database queries if and only if you are sure that your database connection is using ASCII, UTF-8, or ISO-8859-* and that the backslash is your database's escape character. If you're not sure, then use mysqli_real_escape_string instead. This function is not safe to use on databases with multi-byte character sets.”
    - buboard 8y ago
      you're focusing on a function with a known limitation, that was superceded 15 years ago and practically everyone used mysql_real since then. That's not the reason why the module was removed though. The reason is that the mysql_* functions are "too low level for noobs". https://stackoverflow.com/questions/16859477/why-are-phps-mysql-functions-deprecated https://stackoverflow.com/questions/16859477/why-are-phps-my...
- codedokode 8y ago
  That is a function made by MySQL developers [1]. Why don't you blame Sun or Oracle or a Swedish company whose name I don't remember for this? [1] https://dev.mysql.com/doc/refman/8.0/en/mysql-escape-string.html https://dev.mysql.com/doc/refman/8.0/en/mysql-escape-string....
  - emj 8y ago
    You did remember it; "MySQL". It was an joint stock company so it is actually MySQL AB, but that postfix is quite similar to LLC, S.A. or A/S. AB literally translates to stock company, I think the english term is joint stock company
imhoguy 8y ago
> javascript isn't even usable out-of-the-box without a few (hundreds) libraries to make it comfortable to use What? Start small and vanilla: <script type="text/javascript">... <?php ... You always have a chance of drowning in complexity with whatever you use: Webpack, Compose, Laravel, Make, JSX, SSR, apt-get...
- coldtea 8y ago
  This "small and vanilla" lacks 1000s of helpful functions PHP has built-in in its standard library, that's what the parent says.
  - imhoguy 8y ago
    Right, but PHP alone is also not "usable out-of-the-box" if it needs hundreds of third-party dependencies, whatever as static compiled bundle or linked distro, libc, libmysql, libgd, so on... Comparing generic language with language bundle is unfair - that is my point.

bradleyjg 8y ago

Fast and useful stuff like mysql_escape_string?

krapp 8y ago
That's been deprecated for years, removed from current PHP and was just a wrapper around an existing C library to begin with. If you want to blame the current language for its former vulnerabilities, fine, but comparing apples to apples would mean looking at all of the terrible ways in which javascript has been integrated into the browser and OS over the years, particularly with Internet Explorer. And I can guarantee you, from personal experience, that PHP is not the only language in which string concatenation with variables is the most common means of writing SQL queries.
- bradleyjg 8y ago
  I’m not defending js. On the contrary the two languages are similar in that early on a lot of people had a negative first impression because of some mind bogglingly stupid decisions made by the initial implementators. This lead to feedback loops where those that were repulsed by those negative impressions moved on to other languages while those that didn’t care stuck around. In both cases that lead to cowboy cultures developing. It is true that in both cases, eventually top notch engineers got involved in the projects’ core and cleaned things up to the extent possible. But it’s a heck of a lot easier to improve a spec than a culture.
buboard 8y ago
Yet, this ancient library did not have serious issues. It was not deprecated because someone hacked it or it was even bad, but because it had not been maintained for many years. The reason was probably that it did not need maintainance, it just worked, but programmers often used it in the wrong way. In fact, the removal from PHP has caused some very small and old projects to break, and IMHO php should not have removed it, for the sake of compatibility. Also, it is much faster than the suggested alternative (pdo).
- bradleyjg 8y ago
  It did have serious security issues. That’s why not long after there was another function added named mysql_real_escape_string.
  - duskwuff 8y ago
    No, that's not true. That function name was copied directly from the MySQL C API. It was not added by PHP. https://dev.mysql.com/doc/refman/5.5/en/mysql-real-escape-string.html https://dev.mysql.com/doc/refman/5.5/en/mysql-real-escape-st...
    - bradleyjg 8y ago
      “You can use this function safely with your MySQL database queries if and only if you are sure that your database connection is using ASCII, UTF-8, or ISO-8859-* and that the backslash is your database's escape character. If you're not sure, then use mysqli_real_escape_string instead. This function is not safe to use on databases with multi-byte character sets.”
  - buboard 8y ago
    you're focusing on a function with a known limitation, that was superceded 15 years ago and practically everyone used mysql_real since then. That's not the reason why the module was removed though. The reason is that the mysql_* functions are "too low level for noobs". https://stackoverflow.com/questions/16859477/why-are-phps-mysql-functions-deprecated https://stackoverflow.com/questions/16859477/why-are-phps-my...
codedokode 8y ago
That is a function made by MySQL developers [1]. Why don't you blame Sun or Oracle or a Swedish company whose name I don't remember for this? [1] https://dev.mysql.com/doc/refman/8.0/en/mysql-escape-string.html https://dev.mysql.com/doc/refman/8.0/en/mysql-escape-string....
- emj 8y ago
  You did remember it; "MySQL". It was an joint stock company so it is actually MySQL AB, but that postfix is quite similar to LLC, S.A. or A/S. AB literally translates to stock company, I think the english term is joint stock company

imhoguy 8y ago

> javascript isn't even usable out-of-the-box without a few (hundreds) libraries to make it comfortable to use What? Start small and vanilla: <script type="text/javascript">... <?php ... You always have a chance of drowning in complexity with whatever you use: Webpack, Compose, Laravel, Make, JSX, SSR, apt-get...

coldtea 8y ago
This "small and vanilla" lacks 1000s of helpful functions PHP has built-in in its standard library, that's what the parent says.
- imhoguy 8y ago
  Right, but PHP alone is also not "usable out-of-the-box" if it needs hundreds of third-party dependencies, whatever as static compiled bundle or linked distro, libc, libmysql, libgd, so on... Comparing generic language with language bundle is unfair - that is my point.