8 ms·

You can create a mess of code, open security holes, and/or be hit with ‘gotchas’ in any web framework. PHP is much less complex than most.

agumonkey 8y ago
no, seriously, the old dynamic script as program requiring a web server needed to be configured properly to avoid leaks of a thousand faces .. thanks but no thanks I'll be flask-ing
- KerryJones 8y ago
  Just use Laravel and its eco-system, it's just as easy or easier to setup than Flask and easily production ready. This is an old-take on PHP and no longer true in 2019.
  - agumonkey 8y ago
    I know about laravel, but that above comment mentioned LAMP era as golden .. you know
viraptor 8y ago
These are things very specific to PHP. Yes, there are language-specific gotchas in many environments. But I'm criticising specific things that do exist and that I've seen causing issues in real deployments. Things that make PHP accessible make it also an excellent footgun.
- furicane 8y ago
  So.. what you're trying to highlight is that a language is supposed to make up for the incompetence of the person using it?
  - yakshaving_jgt 8y ago
    Yes. Humans are fallible. That is an immutable truth. There’s no great wisdom in relying on human discipline alone to produce reliable software.
  - coldtea 8y ago
    Of course. That's the only reason to invent languages: to take care of stuff people are not good taking care of, and move the work to the computer, allowing us to work on the level that we're good at taking care of. Else we'd all be using assembly. There's absolutely no pride or glory in doing things nicely and securely that the computer could have automated in the first place. Anything the language allows that it could refuse while allowing devs to express the same features, and that results in bugs is a mistake in the language (e.g. the sorry state of strings in C).
    - kristopolous 8y ago
      Incompetent people will create incompetent things regardless of the tool. Simpler tools lead to simpler messes while complicated tools lead to complicated messes. I've seen an attitude that people think they can inoculate themselves from inept programming by using obtuse frameworks as if martin-fowler-speak acts as a drill sergeant making disciplined coders out of the herd. But after 20 years of bouncing around startups I've never seen the intended results actually happen a single time. Not even close. Not once. Never. Instead it leads to larger, less maintainable, more convoluted messes that have to be trashed quicker. Giant ceremonial cargo cult style monstrosities with huge circuitous logic - 4, 5, maybe 6 layers, a router calling a controller, calling a service, calling a provider, calling an event model, which runs a single if statement ... as if that's how we protect ourselves against incompetence. These approaches just lead to wasteful projects where they end up rewriting the whole thing in whatever the framework/language de jour is instead of writing easily maintainable, quickly understandable code that's designed to work for the next 10 years. I've talked to many programmers who are embarrassed by the language they are using ... wtf is that?! They've turned programming into fast fashion. Then people like to ask what someone's favorite language is, usually when they first meet them, as a social cue, as if we are a bunch of highschool kids following pop music. I mean what on earth... we're supposed to building the future here, not running around like a bunch of spastic fanboys from platform to platform, just to mess everything up all over again in bold new ways using slightly different syntax. The best thing to do is give people the least abstract thing with the fewest conformity requirements ... essentially make it open ended and then the messes are easier to spot and easier to fix. You won't get 4 folders with 26 files handling simple tasks like uploading images to an S3 bucket (saw this huge mess just last week and guess what?! It's broken. I know, surprising right?) Anyway, new shiny fancy tools with GoF buzzwords won't ever fix incompetence, it'll only make it worse.
- dangerface 8y ago
  These things are very generic and apply to both lua and asp. Invisible characters are a problem in every language, configuration file, file period, trying to suggest that its specific to php is just silly.
  - viraptor 8y ago
    The difference is in handling though. If a config file runs into a BOM, it's likely to tell you on which column and row (0,1) it broke. Same when you compile something. Or it may even recognise the BOM and handle it transparently. PHP does something different. It outputs it early and when you try to send a header it tells you that's too late. That error is in no way helpful to you at that point unless you already know about this issue, and it won't even help you figure out which file was affected. That part is specific to PHP. I'm not familiar with Lua pages, but all I can find uses a http / fastcgi server with explicit routing. ASP classic has its own terrible ideas and it's close to death now - 2025 is the last year MS committed to support it, so I don't really think of it as an interesting language anymore.
the_gipsy 8y ago
With PHP it is much easier to hit all of the above.
- jonwinstanley 8y ago
  PHP is also easier to get started, easier to understand and easier to modify. So it's a trade off.
  - dingdingdang 8y ago
    > PHP is also easier to get started, easier to understand and easier to modify. So it's a trade off. And as a result also easier to achieve proficiency in.
  - Aaargh20318 8y ago
    This also leads beginners to overestimate themselves, resulting in piles of live, insecure PHP code. Just because it works, doesn't mean it's good or secure. And while it's very easy to see if something works or not, it's very hard to see if something is secure.
  - eeeeeeeeeeeee 8y ago
    I think you indicated the problem. You can be secure or insecure in just about any language, but the barrier to entry is so low in PHP that it is easiest for beginners to do a lot of damage while still launching an app. I’d rather there be some learning curve so people understand what they’re doing (or not doing).
eeZah7Ux 8y ago
PHP has a terrible track record for security.
52-6F-62 8y ago
Eh, maybe for something simple. In a complex product (as in, most professional settings or large services/web sites) the PHP I've seen is grossly complex, and not intuitive—especially WordPress deployments. Dev teams have to perform all kinds of gymnastics with the PHP code to get it to do what they want, and it's just a flat out nightmare that I've made sure my boss and colleagues know that I have no desire to work with it. It always ends up a house of cards and full of vulnerabilities so that something is regularly getting exposed that allows at least editorial access. Security issues that should otherwise be no problem. God knows how many other vulnerabilities exist. Every single server I've ever had has had bots and crawlers polling for common PHP files in an effort to exploit them, should they exist. I just don't like having even the chance that my back-end source could, for want of a single character, spill out to a web page upon request. And then there's performance... Anyway for simple things, sure. For things that don't require much security, sure. For anything else... it's not for me.
- chiefalchemist 8y ago
  > "...especially WordPress deployments." I've done enough WP to certainly agree with you. However, I don't think it's fair to judge PHP by how WP has abused it. WP problem is its desire to sacrifice code quality and best practices for market share. That is, many things don't get refactored (into something OOP based) because there might be backwards compatibility issues. Again, this isn't PHP's fault.
  - 52-6F-62 8y ago
    I'm not all out against PHP. I've used, and still do, on occasion for simple things and prototyping. That said, I'll never go out of my way to use it for much else—let alone serving and routing something public-facing ever again.
    - KerryJones 8y ago
      Checkout Laravel, it powers some Fortune 100 sites -- it's definitely "large-site" capable.
stcredzero 8y ago
You can create a mess of code, open security holes, and/or be hit with ‘gotchas’ in any web framework Yes, but the holes and gotchas are worse when they are baked into the language. The thing that Golang gets right, is that the developers are willing to eschew features to avoid gotchas. It's like other languages are sports cars with sexy lines and fancy features that everyone wants, but have to spend more time "in the shop." (An analogy for in the debugger.) Golang is more like a base model Toyota Corolla with a manual transmission. Not sure what PHP is like. Maybe some sort of modder car. Like Perl and Ruby, PHP grew by readily adding features in response to demand. In that way, it's the opposite of Golang. PHP is much less complex than most. That depends on what level you're looking at. PHP is one of those languages that has a lot of complexity baked into it in the form of language design warts. In order to make it a nimble language, you have to ignore/eschew parts of it, and stick to some "good parts."

agumonkey 8y ago

no, seriously, the old dynamic script as program requiring a web server needed to be configured properly to avoid leaks of a thousand faces .. thanks but no thanks I'll be flask-ing

KerryJones 8y ago
Just use Laravel and its eco-system, it's just as easy or easier to setup than Flask and easily production ready. This is an old-take on PHP and no longer true in 2019.
- agumonkey 8y ago
  I know about laravel, but that above comment mentioned LAMP era as golden .. you know

viraptor 8y ago

These are things very specific to PHP. Yes, there are language-specific gotchas in many environments. But I'm criticising specific things that do exist and that I've seen causing issues in real deployments. Things that make PHP accessible make it also an excellent footgun.

furicane 8y ago
So.. what you're trying to highlight is that a language is supposed to make up for the incompetence of the person using it?
- yakshaving_jgt 8y ago
  Yes. Humans are fallible. That is an immutable truth. There’s no great wisdom in relying on human discipline alone to produce reliable software.
- coldtea 8y ago
  Of course. That's the only reason to invent languages: to take care of stuff people are not good taking care of, and move the work to the computer, allowing us to work on the level that we're good at taking care of. Else we'd all be using assembly. There's absolutely no pride or glory in doing things nicely and securely that the computer could have automated in the first place. Anything the language allows that it could refuse while allowing devs to express the same features, and that results in bugs is a mistake in the language (e.g. the sorry state of strings in C).
  - kristopolous 8y ago
    Incompetent people will create incompetent things regardless of the tool. Simpler tools lead to simpler messes while complicated tools lead to complicated messes. I've seen an attitude that people think they can inoculate themselves from inept programming by using obtuse frameworks as if martin-fowler-speak acts as a drill sergeant making disciplined coders out of the herd. But after 20 years of bouncing around startups I've never seen the intended results actually happen a single time. Not even close. Not once. Never. Instead it leads to larger, less maintainable, more convoluted messes that have to be trashed quicker. Giant ceremonial cargo cult style monstrosities with huge circuitous logic - 4, 5, maybe 6 layers, a router calling a controller, calling a service, calling a provider, calling an event model, which runs a single if statement ... as if that's how we protect ourselves against incompetence. These approaches just lead to wasteful projects where they end up rewriting the whole thing in whatever the framework/language de jour is instead of writing easily maintainable, quickly understandable code that's designed to work for the next 10 years. I've talked to many programmers who are embarrassed by the language they are using ... wtf is that?! They've turned programming into fast fashion. Then people like to ask what someone's favorite language is, usually when they first meet them, as a social cue, as if we are a bunch of highschool kids following pop music. I mean what on earth... we're supposed to building the future here, not running around like a bunch of spastic fanboys from platform to platform, just to mess everything up all over again in bold new ways using slightly different syntax. The best thing to do is give people the least abstract thing with the fewest conformity requirements ... essentially make it open ended and then the messes are easier to spot and easier to fix. You won't get 4 folders with 26 files handling simple tasks like uploading images to an S3 bucket (saw this huge mess just last week and guess what?! It's broken. I know, surprising right?) Anyway, new shiny fancy tools with GoF buzzwords won't ever fix incompetence, it'll only make it worse.
dangerface 8y ago
These things are very generic and apply to both lua and asp. Invisible characters are a problem in every language, configuration file, file period, trying to suggest that its specific to php is just silly.
- viraptor 8y ago
  The difference is in handling though. If a config file runs into a BOM, it's likely to tell you on which column and row (0,1) it broke. Same when you compile something. Or it may even recognise the BOM and handle it transparently. PHP does something different. It outputs it early and when you try to send a header it tells you that's too late. That error is in no way helpful to you at that point unless you already know about this issue, and it won't even help you figure out which file was affected. That part is specific to PHP. I'm not familiar with Lua pages, but all I can find uses a http / fastcgi server with explicit routing. ASP classic has its own terrible ideas and it's close to death now - 2025 is the last year MS committed to support it, so I don't really think of it as an interesting language anymore.

the_gipsy 8y ago

With PHP it is much easier to hit all of the above.

jonwinstanley 8y ago
PHP is also easier to get started, easier to understand and easier to modify. So it's a trade off.
- dingdingdang 8y ago
  > PHP is also easier to get started, easier to understand and easier to modify. So it's a trade off. And as a result also easier to achieve proficiency in.
- Aaargh20318 8y ago
  This also leads beginners to overestimate themselves, resulting in piles of live, insecure PHP code. Just because it works, doesn't mean it's good or secure. And while it's very easy to see if something works or not, it's very hard to see if something is secure.
- eeeeeeeeeeeee 8y ago
  I think you indicated the problem. You can be secure or insecure in just about any language, but the barrier to entry is so low in PHP that it is easiest for beginners to do a lot of damage while still launching an app. I’d rather there be some learning curve so people understand what they’re doing (or not doing).

eeZah7Ux 8y ago

PHP has a terrible track record for security.

52-6F-62 8y ago

Eh, maybe for something simple. In a complex product (as in, most professional settings or large services/web sites) the PHP I've seen is grossly complex, and not intuitive—especially WordPress deployments. Dev teams have to perform all kinds of gymnastics with the PHP code to get it to do what they want, and it's just a flat out nightmare that I've made sure my boss and colleagues know that I have no desire to work with it. It always ends up a house of cards and full of vulnerabilities so that something is regularly getting exposed that allows at least editorial access. Security issues that should otherwise be no problem. God knows how many other vulnerabilities exist. Every single server I've ever had has had bots and crawlers polling for common PHP files in an effort to exploit them, should they exist. I just don't like having even the chance that my back-end source could, for want of a single character, spill out to a web page upon request. And then there's performance... Anyway for simple things, sure. For things that don't require much security, sure. For anything else... it's not for me.

chiefalchemist 8y ago
> "...especially WordPress deployments." I've done enough WP to certainly agree with you. However, I don't think it's fair to judge PHP by how WP has abused it. WP problem is its desire to sacrifice code quality and best practices for market share. That is, many things don't get refactored (into something OOP based) because there might be backwards compatibility issues. Again, this isn't PHP's fault.
- 52-6F-62 8y ago
  I'm not all out against PHP. I've used, and still do, on occasion for simple things and prototyping. That said, I'll never go out of my way to use it for much else—let alone serving and routing something public-facing ever again.
  - KerryJones 8y ago
    Checkout Laravel, it powers some Fortune 100 sites -- it's definitely "large-site" capable.

stcredzero 8y ago

You can create a mess of code, open security holes, and/or be hit with ‘gotchas’ in any web framework Yes, but the holes and gotchas are worse when they are baked into the language. The thing that Golang gets right, is that the developers are willing to eschew features to avoid gotchas. It's like other languages are sports cars with sexy lines and fancy features that everyone wants, but have to spend more time "in the shop." (An analogy for in the debugger.) Golang is more like a base model Toyota Corolla with a manual transmission. Not sure what PHP is like. Maybe some sort of modder car. Like Perl and Ruby, PHP grew by readily adding features in response to demand. In that way, it's the opposite of Golang. PHP is much less complex than most. That depends on what level you're looking at. PHP is one of those languages that has a lot of complexity baked into it in the form of language design warts. In order to make it a nimble language, you have to ignore/eschew parts of it, and stick to some "good parts."