15 ms·

80% of the Web Powered by PHP (2017)

184 points by ashitlerferad 8y ago

piotrkubisa 8y ago
I think link should be changed to https://w3techs.com/technologies/details/pl-php/all/all https://w3techs.com/technologies/details/pl-php/all/all, because it points to more actual results. On that page, we can see a diagram that shows many websites has not been updated to work with latest PHP 7+, which I'd say is quite shameful and/or method used by authors of this report to check PHP version is not adequate (I guess it is now a common standard to hide version of the used interpreter in a HTTP header, while it wasn't obvious todo task when only 5.x was available). Additionally, I found it is quite wrong to putting equal mark between PHP and Hack (HHVM) in section of "Popular sites using PHP". Edit: Fixed some language errors and typos.
- jwat0v 8y ago
  I don't know if it's shameful but it's expected. Of those PHP websites, most of them are probably wordpress. How many of those haven't been updated in ages? That's way more dangerous than running PHP 5, taking into account all distros will backport security fixes for years to come.
  - simion314 8y ago
    From my experience WP autoupdates Do you expect all node small and medium completed projects run on latest node?
    - corobo 8y ago
      WordPress core autoupdates. Plugins will happily remain exploitable for years if you're not on top of their security updates.
  - piotrkubisa 8y ago
    Yes, that's true you can find many web sites using Wordpress, or other popular CMSes like Joomla, forum boards i.e. phpBB or even e-commerce stores based on OpenCart / ZenCart / Prestashop haven't seen an update for a quite long time. Personally, I'd be glad to offer my free time to help i.e. update Wordpress (recent versions has auto-update feature) or even migrate to static-site, especially whether I am returning user of such website.
    - antsar 8y ago
      The hard part isn’t updating. It’s checking what got broken by the update, and fixing that. Then finding out one of the plugins is no longer supported, researching alternatives, and rebuilding half the site to use a new thing.
      - piotrkubisa 8y ago
        Tip: static analysis tools for PHP helped me during a rewrite from 5.6 to 7.0. It was really good experience, I'd say.
        antsar 8y ago
        Same here. Sadly, I don't know of any static analysis tools that can detect inter-compatibility of different versions of WordPress plugins/themes/core. That's one aspect of WordPress maintenance that can get real hairy.
  - uses 8y ago
    Probably worth noting that WP is planning on requiring PHP 7 by the end of 2019 https://make.wordpress.org/core/2018/12/08/updating-the-minimum-php-version/ https://make.wordpress.org/core/2018/12/08/updating-the-mini...
- pjmlp 8y ago
  Many ISPs now do opt-in for their customers. For example by default the Website runs in PHP 5.6 and it is up to the site owner to change the local site version to a newer version via cPanel or similar. So non technical users that just know a bit of PHP or use some CMS, end up being stuck with the default version.
- teh_klev 8y ago
  > that shows many websites has not been updated to work with latest PHP 7+, which I'd say is quite shameful Speaking as an ex-hoster here who had to look after a fleet of shared servers running PHP (000's of sites) for 15 years, sadly life is not that simple in the trenches. The major problem with PHP is breaking changes. Even within the 5.x releases there were enough breaking changes such that upgrading from say 5.3 to 5.6 could break a site. The jump from 5.6 to 7.x has enough breaking changes to make you cry. I think there should have been a commitment to maintain 5.6 for the next ten years, if only for security fixes. Now I'm not suggesting that developers shouldn't go back and fix stuff that breaks because the PHP folks removed/altered that functionality (with the good intentions of encouraging more secure programming, for example), but there's a labour cost and someone needs to pay for that time. There's also functionality in PHP that shouldn't have been removed (register_globals) but should have been defaulted to disabled. Sure register_globals is insecure but what we saw were folks adding the same functionality back, just google for "php emulate register_globals". And don't get me started about the annoyance that was removing mysql_* support. Those exact same insecure string concatenated queries are still being executed via mysqli_* and the PDO libraries. In my experience, binning mysql_* didn't make a damn bit of difference when it came to sql injection attacks. Don't get me wrong, I admire the efforts of the PHP core team, but they made a rod for our already sore support backs whenever a new release of PHP shipped because of some fairly unnecessary BC's.
  - buboard 8y ago
    yeah the mysql_* function removal happened for no reason whatsoever. A library that did not need maintainance is something to keep , not throw away.
    - nkozyra 8y ago
      Even though it had no paramaterized/prepared queries and made injection issues abundant?
      - buboard 8y ago
        not a fault of the library itself. also, mysqli_* has the same issue, was not removed
- acomjean 8y ago
  Since the article is from 2017 php 7 was kind of newish then. I think its seen pretty rapid adoption (mainly because additional speed means fewer servers.). PHP has adopted a strategy of rolling version upgrades with defined end points. They probably should have some "LTS (Long Term Support) type releases. http://php.net/supported-versions.php http://php.net/supported-versions.php 5.6 just reached eol. I think they've put out a securtiy patch since then so its (not quite) completely abandoned. If people aren't forced to upgrade their sites, they won't. So there is huge incentive to just keep running the older versions.
- tzs 8y ago
  Many sites run an LTS release of a Linux distribution until support ends, and then update to either the next or the latest LTS release of that distribution, which they then stay on as long as it is support, and so on. Debian 8 (Jessie) still has a little over a year left, for example, and is on PHP 5. Ubuntu 14 is just nearing the end of support, and is on PHP 5. Same with OpenSUSE and CentOS. I'm not sure what the Red Hat situation is, because the pages at Redhat that Google found that would probably tell me are in the knowledge base, and will only show me the question, telling me I have to be a Red Hat subscriber to see the answer. This is one of the annoyances with some major frameworks. According to both the Symfony and Laravel requirements pages, they need PHP 7.1.3. As far as I can tell that's not included in any LTS release of any major Linux distribution, which top out at 7.0.33 currently, I believe. PS: interesting oddity somewhere in HN. When on the "reply" screen for your comment, HN says your comment is 1 day old. However, back in the thread, or on a direct link to your comment, it says that it is 6 hours old. It does the same thing for all 6 hour old comments in this thread, but not 5 hour old comments.
  - btreecat 8y ago
    And this is why as a developer, I adopted docker. Oh you cant run lib/framework/tool due to host deps? No problem, I will just replace you with a script.
onion2k 8y ago
This is wrong. What they're measuring isn't the number of websites that use a particular technology, but the number of websites that report they're using a technology. In the case of PHP that means expose_php is set to true in the ini file, and Apache is configured so use "ServerSignature On". Those are the defaults, and they're arguably bad defaults because gathering information about a target is Hacking 101. You definitely shouldn't be giving away version numbers unless you're really good at patching stuff on day 1. What this survey means is that PHP gives away data about your web apps internal structure. Most other web technologies don't do this. The defaults are more sane. They're not adding x-headers to every request about what versions of which technologies the server is running. If you dig a bit you'll see this line in the source data: "PHP is used by 79% of all the websites whose server-side programming language we know." (https://w3techs.com/technologies/overview/programming_language/all https://w3techs.com/technologies/overview/programming_langua... under "How to read this diagram") tl;dr PHP server admin need to get better at security.
- tyingq 8y ago
  Assuming most are running WordPress, Drupal, etc, hiding the fact that you're running PHP is a bit fruitless. Those platforms are dead simple to identify by the URL paths of components, like /wp-content/whatever and other similar clues. I do agree that exposing the version isn't a great idea.
  - Theodores 8y ago
    https://github.com/AliasIO/Wappalyzer/blob/master/src/apps.json https://github.com/AliasIO/Wappalyzer/blob/master/src/apps.j... Handy reference from the Wappalyzer browser extension for you.
arendtio 8y ago
Well, the question is why so many admins stick with PHP 5. My guess is that due to the breaking changes that came with PHP 7: https://en.wikipedia.org/wiki/PHP#PHP_7 https://en.wikipedia.org/wiki/PHP#PHP_7
- merb 8y ago
  it is also shocking that they use php 5.5, which basically is unsupported for two years. Well PHP 5.6 is unsupported aswell, but it was supported till december 2018..
  - dan1234 8y ago
    5.6 is officially unsupported but did actually get a security patch in January, with the possibility of further updates if warranted[1] [1]http://php.net/archive/2019.php#id2019-01-10-4 http://php.net/archive/2019.php#id2019-01-10-4
  - kijin 8y ago
    Ubuntu 14.04 shipped with PHP 5.5 by default, and it's supported until next month. I don't know how well the maintainers backport security fixes from newer versions, but at least technically it's still supported. The last security update to php5-common on trusty came out only a few days ago. End of upstream support is meaningless in a world where most servers run LTS distros of one flavor or another. I've been telling my clients that they should be able to rely on PHP 7.2 for a long, long time because it's the default version in Ubuntu 18.04 and RHEL/CentOS 8, both of which come with 10 years of support.
- folkrav 8y ago
  1. Bunch of up-and-forget sites on shared hosts 2. A metric ton of legacy codebases that plain don't work on PHP > 5.5 3. PHP 7 had quite a few breaking changes, like you mentioned 4. Laziness
  - deleted 8y ago
    [deleted]
mutt2016 8y ago
I think this speaks more to people running lts versions of servers that have php5 in repos.
- jdhawk 8y ago
  Looking at you CENTOS
  - Spivak 8y ago
    But that's the value proposition of a distro like that. Write your app against whatever is in the repos in the .0 release and get a stable ABI until the next major release in a little over a decade.
  - passthejoe 8y ago
    CentOS has repos that allow you to install other versions of PHP. I have PHP 7 on a CentOS 6 server.
liveoneggs 8y ago
this site has tons of trends and is probably more up to date: https://trends.builtwith.com/framework/programming-language https://trends.builtwith.com/framework/programming-language they have tons of other metrics. To summarize PHP and Wordpress absolutely dominate the web.
RocketSyntax 8y ago
Would like to see "sites" vs "webapps"
- koboll 8y ago
  What's the difference? WordPress, for example, is arguably a web app.
  - glvn 8y ago
    It's really hard to classify WP as one or the other. Depending on what setup & plugins you are running it could either be essentially a static site or one that a web app for all intents and purposes.
- bigblind 8y ago
  That's quite a blurry line, though. How much functionality does a site need to become a web app?
  - kowdermeister 8y ago
    In my definition: Website: main focus is information serving, documents, designs, texts, assets, etc. Webapp: users can create some kind of output from the service that's based on creative input. The line is still blurry, but more narrow and contrasted.
  - derefr 8y ago
    I would describe a web-app as “any website that can’t be replaced by a Static Site Generator outputting to a public_html directory of a stock-standard Apache 1.3 installation on a locked-down server that has no CGI-bin.” (So, the SSG could output .htaccess files, and even files that contain Server Side Includes, but can’t do CGI, FCGI/WSGI, PHP, or in-server Lua like OpenResty.) Or, a simpler definition: a webapp is any website that you can’t effectively host on your ca. 1995 ISP’s web hosting. Many webapps where the “app” is purely in a CMS backend (e.g. most Wordpress sites) are websites. Unless they include comments, in which case they’re not. Unless those comments are JavaScript-embedded third-party (e.g. Disqus) comments, in which case they are. :)
vikaskyadav 8y ago
That is mostly because of Wordpress
- maxk42 8y ago
  According to WordPress, it's about 25%. [1] So it would mostly be not-WordPress. [1] https://venturebeat.com/2015/11/08/wordpress-now-powers-25-of-the-web/ https://venturebeat.com/2015/11/08/wordpress-now-powers-25-o...
  - liveoneggs 8y ago
    that is out of date- wordpress is up to over 33% of the web https://wordpress.org/news/2019/03/one-third-of-the-web/ https://wordpress.org/news/2019/03/one-third-of-the-web/ That's the entire web. It is staggering.
EGreg 8y ago
People have asked us why we use PHP in 2019, sometimes scoffed at us. This is why.
- astazangasta 8y ago
  "This" being "everyone else is doing it"? Doesn't seem a great reason.
  - EGreg 8y ago
    No. We have a platform (https://qbix.com/blog https://qbix.com/blog) that needs to run on as many commodity hosts as possible, so as to form a cloud that isn’t centralized in Google and Amazon. We are building a Wordpress-like decentralized open source alternative to Facebook and Google.
    - pdimitar 8y ago
      If "commodity hosts" doesn't include "ancient PHP shared hosting in Russia and India" then you are free from PHP itself and can build your platform on anything else.
      - pxtail 8y ago
        > you are free from PHP itself and can build your platform on anything else Sure, but why? Why one should discard proven,highly performant and well working solution with tons of already written and ready to use high quality frameworks and libraries? Why one should try to replace internet's "workhorse" with FOTM language/solution? Just because of hype on reddit and HN? I know that PHP (and Java) is out of fashion right now but it's worth to be calm, ignore buzzword hype and use best solutions for problems.
        pdimitar 8y ago
        If not using PHP means that people are "using a FOTM language" then I don't think we can have a productive discussion since you're expressing disrespect right from the get go. The world isn't black and white and will never be. Don't oversimplify.
paulcarroty 8y ago
Right time to learn Node.js :)
smrtinsert 8y ago
6 months coding php. Never again.
- frfl 8y ago
  Care to go into some details?
matthewfelgate 8y ago
I'd like to see websites excluding WordPress.
- cturhan 8y ago
  It's not just wordpress. There are magento, joomla, drupal...
dep_b 8y ago
PHP 7: didn't use it too much yet but things definitely have been improving on the syntax side! But doing PHP is 80% awful jobs and 20% cool companies so it's not something I would put too high up on my resumé.
_RPM 8y ago
This is slightly off topic. But PHP has a great devloper experience, in general, now with vscode, and autocomplate, find all references, etc. But the best framework out there is Laravel. It's great, but the maintainer doesn't seem reliable. Every single release has some type of backwards incompaitible change to it of which they don't document all the changes. So it's basically a blackbox if you are to upgrade your laravel/framework version.
- ficiek 8y ago
  The PHP experience was one of the worst experiences I have ever experienced.
  - ClashTheBunny 8y ago
    What year was this?
  - _RPM 8y ago
    PHP is very fast. The tooling is great, and it's very easy to get started. VSCode with the right extensions makes PHP development fun.
    - dcbadacd 8y ago
      D: Which are the "right extensions" because what I saw was not "fun" at all.
  - la_fayette 8y ago
    Have you ever built a web application with java?
    - nobleach 8y ago
      Java EE? Yeah, I did not enjoy that at all. The current blend of Spring Boot, Micronaut, Vert.x, or especially Quarkus.io? I love it!
devsatish 8y ago
PHP is not that bad. I used Laravel to build out a PHP based web-app , it was a breeze to build - great developer experience - Eg: Netbeans/Eclipse Syntax editors are easy to use, composer was as easy as rails was. Most of my work was on the JS part though (React/WebVR). Tests, Code Coverage, Deployment to AWS, everything was smooth . This coming from a polyglot dev who built apps with Scala,Python, Java and Ruby
- JohnFen 8y ago
  This polyglot agrees. I actually like PHP for web-related stuff. Everyone may commence the throwing of tomatoes now.
- paulddraper 8y ago
  I've used PHP (pre 7) at $JOB. It's not bad for hacking a project together. In fact, it's kind of ideal. (Though I would personally pick Python.) It is bad when working on a business-grade product with more than a dozen engineers. Bizarre language choices and an intrinsic tendency towards non-encapsulation seems to make even more spaghetti code than you'd find in Ruby, Python, Java, etc.
  - deleted 8y ago
    [deleted]
  - JohnFen 8y ago
    > even more spaghetti code than you'd find in Ruby, Python, Java, etc. From working on numerous large Java projects, I can say with real-world experience that the logical equivalent to spaghetti code is very common with Java. The difference is where the spaghetti is -- in Java, it tends to be spaghetti inheritance and encapsulation.
    - juangacovas 8y ago
      Nice to see more of those "real world" words that confirms that everybody can do clusterfucks (aka spaghetti code) in any language, given the proper time and lazyness ;P
osrec 8y ago
PHP is a great because it lets you get stuff done. Easy to understand, deploy and extend. Also, with the new reactive frameworks such as swoole, it can even support situations where you need to service a very high number of connections. We use it extensively at my firm and are proud to do so. A lot of PHP criticism comes from developer snootiness and a fairly hefty survivorship bias. PHP is good for a bunch of things - let's just be okay with that!
- brianpgordon 8y ago
  Other programming languages "let you get stuff done" without all of the ugly warts and rough edges of PHP. And the only survivorship bias involved is that only developers with a high tolerance for terrible programming languages stick with PHP so the community disappears into its own navel in an endless cycle of awfulness. Calling this developer snootiness is like building houses with stone hand tools and scoffing at the workers who won't join your construction company until you buy some hammers.
  - osrec 8y ago
    Not really. PHP is not awful. It powers much of the web because it's actually good at its job. What's your programming language of choice? I bet you will find ample, justified criticism of it too.
- mgkimsal 8y ago
  i've taken to writing some console-oriented tools in PHP for projects (and sometimes just my own stuff). It hit me years ago that it was pretty easy to do stuff like db connections, decent filehandling, etc as one-off scripting vs bash. Sure, perl/ruby/python are there, but if you're already using PHP for a main project, extending cli stuff out in to PHP as well is handy (handier than bash, by comparison). PHP can scale up or down, but some tools are harder to 'scale down' - by that I mean be able to be used for short one-off things (cli tools, etc). I'm not saying it can't be done, but people don't often write smaller supporting tools (quick text preprocessing before an import, for example) in Java, even when their main projects are in Java. Of course, IME, and YMMV.
rdevsrex 8y ago
I use PHP everyday and it rocks for what it does when you use it with best practices. The real problem is with small companies who won’t or don’t upgrade their infrastructure on a regular basis. Heck, even with Wordpress these days you could use it as an API source and build a modern SPA website. It’s just getting over the inertia of intransigent stakeholders.
4FNET7 8y ago
What about PHP RoadRunner, PHP Swoole, ReactPHP, ... ?
- bufferoverflow 8y ago
  I recently benchmarked Swoole. It's insanely fast compared to regular PHP. It's currently taking #4 place in the famous framework benchmark: https://www.techempower.com/benchmarks/ https://www.techempower.com/benchmarks/
- osrec 8y ago
  Swoole is awesome. We use it in production as does tencent. Documentation needs a bit of work though.
casper345 8y ago
Recent (funny) Observation, I hear more non-programmers trash PHP than actual programmers
- mywittyname 8y ago
  Young programmers too. I guess it's like how people trashed COBOL and Fortran when I was getting into development. Then later in life, I come to find out that Fortran is ubiquitous in engineering and is actually amazing for what it does.
combatentropy 8y ago
I prefer PHP but as glue. Like my first-grade teacher taught us, a drop of glue goes a long way. Too much glue makes a mess. Unlike many programmers, I don't pick one of the Turing-complete programming languages (PHP, Python, Ruby, Go, whatever) and try to write as much of my app as possible in it. Because they are Turing complete, you really can write everything in it. Because you can learn only so much, you are tempted to write more than you should in that language. But like I said, PHP is just a part of my stack, and I try my best to make it one of the thinnest layers. The other parts are Postgres, Apache, and the user's browser. I try to use each of those as much as possible. The server operating system also plays a part, and I suppose my stack includes Bash. Basically I try to do as much business logic as possible in Postgres. This leaves PHP to do little more than glue the output of Postgres to HTML templates.
- sebastianavina 8y ago
  I prefer PHP as a whore. Because we all abuse it, and is damn easy to make it work. But at the end, we all feel dirty for using php.

184 points by ashitlerferad 8y ago

I think link should be changed to https://w3techs.com/technologies/details/pl-php/all/all https://w3techs.com/technologies/details/pl-php/all/all, because it points to more actual results. On that page, we can see a diagram that shows many websites has not been updated to work with latest PHP 7+, which I'd say is quite shameful and/or method used by authors of this report to check PHP version is not adequate (I guess it is now a common standard to hide version of the used interpreter in a HTTP header, while it wasn't obvious todo task when only 5.x was available). Additionally, I found it is quite wrong to putting equal mark between PHP and Hack (HHVM) in section of "Popular sites using PHP". Edit: Fixed some language errors and typos.

jwat0v 8y ago
I don't know if it's shameful but it's expected. Of those PHP websites, most of them are probably wordpress. How many of those haven't been updated in ages? That's way more dangerous than running PHP 5, taking into account all distros will backport security fixes for years to come.
- simion314 8y ago
  From my experience WP autoupdates Do you expect all node small and medium completed projects run on latest node?
  - corobo 8y ago
    WordPress core autoupdates. Plugins will happily remain exploitable for years if you're not on top of their security updates.
- piotrkubisa 8y ago
  Yes, that's true you can find many web sites using Wordpress, or other popular CMSes like Joomla, forum boards i.e. phpBB or even e-commerce stores based on OpenCart / ZenCart / Prestashop haven't seen an update for a quite long time. Personally, I'd be glad to offer my free time to help i.e. update Wordpress (recent versions has auto-update feature) or even migrate to static-site, especially whether I am returning user of such website.
  - antsar 8y ago
    The hard part isn’t updating. It’s checking what got broken by the update, and fixing that. Then finding out one of the plugins is no longer supported, researching alternatives, and rebuilding half the site to use a new thing.
    - piotrkubisa 8y ago
      Tip: static analysis tools for PHP helped me during a rewrite from 5.6 to 7.0. It was really good experience, I'd say.
      - antsar 8y ago
        Same here. Sadly, I don't know of any static analysis tools that can detect inter-compatibility of different versions of WordPress plugins/themes/core. That's one aspect of WordPress maintenance that can get real hairy.
- uses 8y ago
  Probably worth noting that WP is planning on requiring PHP 7 by the end of 2019 https://make.wordpress.org/core/2018/12/08/updating-the-minimum-php-version/ https://make.wordpress.org/core/2018/12/08/updating-the-mini...
pjmlp 8y ago
Many ISPs now do opt-in for their customers. For example by default the Website runs in PHP 5.6 and it is up to the site owner to change the local site version to a newer version via cPanel or similar. So non technical users that just know a bit of PHP or use some CMS, end up being stuck with the default version.
teh_klev 8y ago
> that shows many websites has not been updated to work with latest PHP 7+, which I'd say is quite shameful Speaking as an ex-hoster here who had to look after a fleet of shared servers running PHP (000's of sites) for 15 years, sadly life is not that simple in the trenches. The major problem with PHP is breaking changes. Even within the 5.x releases there were enough breaking changes such that upgrading from say 5.3 to 5.6 could break a site. The jump from 5.6 to 7.x has enough breaking changes to make you cry. I think there should have been a commitment to maintain 5.6 for the next ten years, if only for security fixes. Now I'm not suggesting that developers shouldn't go back and fix stuff that breaks because the PHP folks removed/altered that functionality (with the good intentions of encouraging more secure programming, for example), but there's a labour cost and someone needs to pay for that time. There's also functionality in PHP that shouldn't have been removed (register_globals) but should have been defaulted to disabled. Sure register_globals is insecure but what we saw were folks adding the same functionality back, just google for "php emulate register_globals". And don't get me started about the annoyance that was removing mysql_* support. Those exact same insecure string concatenated queries are still being executed via mysqli_* and the PDO libraries. In my experience, binning mysql_* didn't make a damn bit of difference when it came to sql injection attacks. Don't get me wrong, I admire the efforts of the PHP core team, but they made a rod for our already sore support backs whenever a new release of PHP shipped because of some fairly unnecessary BC's.
- buboard 8y ago
  yeah the mysql_* function removal happened for no reason whatsoever. A library that did not need maintainance is something to keep , not throw away.
  - nkozyra 8y ago
    Even though it had no paramaterized/prepared queries and made injection issues abundant?
    - buboard 8y ago
      not a fault of the library itself. also, mysqli_* has the same issue, was not removed
acomjean 8y ago
Since the article is from 2017 php 7 was kind of newish then. I think its seen pretty rapid adoption (mainly because additional speed means fewer servers.). PHP has adopted a strategy of rolling version upgrades with defined end points. They probably should have some "LTS (Long Term Support) type releases. http://php.net/supported-versions.php http://php.net/supported-versions.php 5.6 just reached eol. I think they've put out a securtiy patch since then so its (not quite) completely abandoned. If people aren't forced to upgrade their sites, they won't. So there is huge incentive to just keep running the older versions.
tzs 8y ago
Many sites run an LTS release of a Linux distribution until support ends, and then update to either the next or the latest LTS release of that distribution, which they then stay on as long as it is support, and so on. Debian 8 (Jessie) still has a little over a year left, for example, and is on PHP 5. Ubuntu 14 is just nearing the end of support, and is on PHP 5. Same with OpenSUSE and CentOS. I'm not sure what the Red Hat situation is, because the pages at Redhat that Google found that would probably tell me are in the knowledge base, and will only show me the question, telling me I have to be a Red Hat subscriber to see the answer. This is one of the annoyances with some major frameworks. According to both the Symfony and Laravel requirements pages, they need PHP 7.1.3. As far as I can tell that's not included in any LTS release of any major Linux distribution, which top out at 7.0.33 currently, I believe. PS: interesting oddity somewhere in HN. When on the "reply" screen for your comment, HN says your comment is 1 day old. However, back in the thread, or on a direct link to your comment, it says that it is 6 hours old. It does the same thing for all 6 hour old comments in this thread, but not 5 hour old comments.
- btreecat 8y ago
  And this is why as a developer, I adopted docker. Oh you cant run lib/framework/tool due to host deps? No problem, I will just replace you with a script.

onion2k 8y ago

This is wrong. What they're measuring isn't the number of websites that use a particular technology, but the number of websites that report they're using a technology. In the case of PHP that means expose_php is set to true in the ini file, and Apache is configured so use "ServerSignature On". Those are the defaults, and they're arguably bad defaults because gathering information about a target is Hacking 101. You definitely shouldn't be giving away version numbers unless you're really good at patching stuff on day 1. What this survey means is that PHP gives away data about your web apps internal structure. Most other web technologies don't do this. The defaults are more sane. They're not adding x-headers to every request about what versions of which technologies the server is running. If you dig a bit you'll see this line in the source data: "PHP is used by 79% of all the websites whose server-side programming language we know." (https://w3techs.com/technologies/overview/programming_language/all https://w3techs.com/technologies/overview/programming_langua... under "How to read this diagram") tl;dr PHP server admin need to get better at security.

tyingq 8y ago
Assuming most are running WordPress, Drupal, etc, hiding the fact that you're running PHP is a bit fruitless. Those platforms are dead simple to identify by the URL paths of components, like /wp-content/whatever and other similar clues. I do agree that exposing the version isn't a great idea.
- Theodores 8y ago
  https://github.com/AliasIO/Wappalyzer/blob/master/src/apps.json https://github.com/AliasIO/Wappalyzer/blob/master/src/apps.j... Handy reference from the Wappalyzer browser extension for you.

arendtio 8y ago

Well, the question is why so many admins stick with PHP 5. My guess is that due to the breaking changes that came with PHP 7: https://en.wikipedia.org/wiki/PHP#PHP_7 https://en.wikipedia.org/wiki/PHP#PHP_7

merb 8y ago
it is also shocking that they use php 5.5, which basically is unsupported for two years. Well PHP 5.6 is unsupported aswell, but it was supported till december 2018..
- dan1234 8y ago
  5.6 is officially unsupported but did actually get a security patch in January, with the possibility of further updates if warranted[1] [1]http://php.net/archive/2019.php#id2019-01-10-4 http://php.net/archive/2019.php#id2019-01-10-4
- kijin 8y ago
  Ubuntu 14.04 shipped with PHP 5.5 by default, and it's supported until next month. I don't know how well the maintainers backport security fixes from newer versions, but at least technically it's still supported. The last security update to php5-common on trusty came out only a few days ago. End of upstream support is meaningless in a world where most servers run LTS distros of one flavor or another. I've been telling my clients that they should be able to rely on PHP 7.2 for a long, long time because it's the default version in Ubuntu 18.04 and RHEL/CentOS 8, both of which come with 10 years of support.
folkrav 8y ago
1. Bunch of up-and-forget sites on shared hosts 2. A metric ton of legacy codebases that plain don't work on PHP > 5.5 3. PHP 7 had quite a few breaking changes, like you mentioned 4. Laziness
- deleted 8y ago
  [deleted]

mutt2016 8y ago

I think this speaks more to people running lts versions of servers that have php5 in repos.

jdhawk 8y ago
Looking at you CENTOS
- Spivak 8y ago
  But that's the value proposition of a distro like that. Write your app against whatever is in the repos in the .0 release and get a stable ABI until the next major release in a little over a decade.
- passthejoe 8y ago
  CentOS has repos that allow you to install other versions of PHP. I have PHP 7 on a CentOS 6 server.

liveoneggs 8y ago

this site has tons of trends and is probably more up to date: https://trends.builtwith.com/framework/programming-language https://trends.builtwith.com/framework/programming-language they have tons of other metrics. To summarize PHP and Wordpress absolutely dominate the web.

RocketSyntax 8y ago

Would like to see "sites" vs "webapps"

koboll 8y ago
What's the difference? WordPress, for example, is arguably a web app.
- glvn 8y ago
  It's really hard to classify WP as one or the other. Depending on what setup & plugins you are running it could either be essentially a static site or one that a web app for all intents and purposes.
bigblind 8y ago
That's quite a blurry line, though. How much functionality does a site need to become a web app?
- kowdermeister 8y ago
  In my definition: Website: main focus is information serving, documents, designs, texts, assets, etc. Webapp: users can create some kind of output from the service that's based on creative input. The line is still blurry, but more narrow and contrasted.
- derefr 8y ago
  I would describe a web-app as “any website that can’t be replaced by a Static Site Generator outputting to a public_html directory of a stock-standard Apache 1.3 installation on a locked-down server that has no CGI-bin.” (So, the SSG could output .htaccess files, and even files that contain Server Side Includes, but can’t do CGI, FCGI/WSGI, PHP, or in-server Lua like OpenResty.) Or, a simpler definition: a webapp is any website that you can’t effectively host on your ca. 1995 ISP’s web hosting. Many webapps where the “app” is purely in a CMS backend (e.g. most Wordpress sites) are websites. Unless they include comments, in which case they’re not. Unless those comments are JavaScript-embedded third-party (e.g. Disqus) comments, in which case they are. :)

vikaskyadav 8y ago

That is mostly because of Wordpress

maxk42 8y ago
According to WordPress, it's about 25%. [1] So it would mostly be not-WordPress. [1] https://venturebeat.com/2015/11/08/wordpress-now-powers-25-of-the-web/ https://venturebeat.com/2015/11/08/wordpress-now-powers-25-o...
- liveoneggs 8y ago
  that is out of date- wordpress is up to over 33% of the web https://wordpress.org/news/2019/03/one-third-of-the-web/ https://wordpress.org/news/2019/03/one-third-of-the-web/ That's the entire web. It is staggering.

EGreg 8y ago

People have asked us why we use PHP in 2019, sometimes scoffed at us. This is why.

astazangasta 8y ago
"This" being "everyone else is doing it"? Doesn't seem a great reason.
- EGreg 8y ago
  No. We have a platform (https://qbix.com/blog https://qbix.com/blog) that needs to run on as many commodity hosts as possible, so as to form a cloud that isn’t centralized in Google and Amazon. We are building a Wordpress-like decentralized open source alternative to Facebook and Google.
  - pdimitar 8y ago
    If "commodity hosts" doesn't include "ancient PHP shared hosting in Russia and India" then you are free from PHP itself and can build your platform on anything else.
    - pxtail 8y ago
      > you are free from PHP itself and can build your platform on anything else Sure, but why? Why one should discard proven,highly performant and well working solution with tons of already written and ready to use high quality frameworks and libraries? Why one should try to replace internet's "workhorse" with FOTM language/solution? Just because of hype on reddit and HN? I know that PHP (and Java) is out of fashion right now but it's worth to be calm, ignore buzzword hype and use best solutions for problems.
      - pdimitar 8y ago
        If not using PHP means that people are "using a FOTM language" then I don't think we can have a productive discussion since you're expressing disrespect right from the get go. The world isn't black and white and will never be. Don't oversimplify.

paulcarroty 8y ago

Right time to learn Node.js :)

smrtinsert 8y ago

6 months coding php. Never again.

frfl 8y ago
Care to go into some details?

matthewfelgate 8y ago

I'd like to see websites excluding WordPress.

cturhan 8y ago
It's not just wordpress. There are magento, joomla, drupal...

dep_b 8y ago

PHP 7: didn't use it too much yet but things definitely have been improving on the syntax side! But doing PHP is 80% awful jobs and 20% cool companies so it's not something I would put too high up on my resumé.

_RPM 8y ago

This is slightly off topic. But PHP has a great devloper experience, in general, now with vscode, and autocomplate, find all references, etc. But the best framework out there is Laravel. It's great, but the maintainer doesn't seem reliable. Every single release has some type of backwards incompaitible change to it of which they don't document all the changes. So it's basically a blackbox if you are to upgrade your laravel/framework version.

ficiek 8y ago
The PHP experience was one of the worst experiences I have ever experienced.
- ClashTheBunny 8y ago
  What year was this?
- _RPM 8y ago
  PHP is very fast. The tooling is great, and it's very easy to get started. VSCode with the right extensions makes PHP development fun.
  - dcbadacd 8y ago
    D: Which are the "right extensions" because what I saw was not "fun" at all.
- la_fayette 8y ago
  Have you ever built a web application with java?
  - nobleach 8y ago
    Java EE? Yeah, I did not enjoy that at all. The current blend of Spring Boot, Micronaut, Vert.x, or especially Quarkus.io? I love it!

devsatish 8y ago

PHP is not that bad. I used Laravel to build out a PHP based web-app , it was a breeze to build - great developer experience - Eg: Netbeans/Eclipse Syntax editors are easy to use, composer was as easy as rails was. Most of my work was on the JS part though (React/WebVR). Tests, Code Coverage, Deployment to AWS, everything was smooth . This coming from a polyglot dev who built apps with Scala,Python, Java and Ruby

JohnFen 8y ago
This polyglot agrees. I actually like PHP for web-related stuff. Everyone may commence the throwing of tomatoes now.
paulddraper 8y ago
I've used PHP (pre 7) at $JOB. It's not bad for hacking a project together. In fact, it's kind of ideal. (Though I would personally pick Python.) It is bad when working on a business-grade product with more than a dozen engineers. Bizarre language choices and an intrinsic tendency towards non-encapsulation seems to make even more spaghetti code than you'd find in Ruby, Python, Java, etc.
- deleted 8y ago
  [deleted]
- JohnFen 8y ago
  > even more spaghetti code than you'd find in Ruby, Python, Java, etc. From working on numerous large Java projects, I can say with real-world experience that the logical equivalent to spaghetti code is very common with Java. The difference is where the spaghetti is -- in Java, it tends to be spaghetti inheritance and encapsulation.
  - juangacovas 8y ago
    Nice to see more of those "real world" words that confirms that everybody can do clusterfucks (aka spaghetti code) in any language, given the proper time and lazyness ;P

osrec 8y ago

PHP is a great because it lets you get stuff done. Easy to understand, deploy and extend. Also, with the new reactive frameworks such as swoole, it can even support situations where you need to service a very high number of connections. We use it extensively at my firm and are proud to do so. A lot of PHP criticism comes from developer snootiness and a fairly hefty survivorship bias. PHP is good for a bunch of things - let's just be okay with that!

brianpgordon 8y ago
Other programming languages "let you get stuff done" without all of the ugly warts and rough edges of PHP. And the only survivorship bias involved is that only developers with a high tolerance for terrible programming languages stick with PHP so the community disappears into its own navel in an endless cycle of awfulness. Calling this developer snootiness is like building houses with stone hand tools and scoffing at the workers who won't join your construction company until you buy some hammers.
- osrec 8y ago
  Not really. PHP is not awful. It powers much of the web because it's actually good at its job. What's your programming language of choice? I bet you will find ample, justified criticism of it too.
mgkimsal 8y ago
i've taken to writing some console-oriented tools in PHP for projects (and sometimes just my own stuff). It hit me years ago that it was pretty easy to do stuff like db connections, decent filehandling, etc as one-off scripting vs bash. Sure, perl/ruby/python are there, but if you're already using PHP for a main project, extending cli stuff out in to PHP as well is handy (handier than bash, by comparison). PHP can scale up or down, but some tools are harder to 'scale down' - by that I mean be able to be used for short one-off things (cli tools, etc). I'm not saying it can't be done, but people don't often write smaller supporting tools (quick text preprocessing before an import, for example) in Java, even when their main projects are in Java. Of course, IME, and YMMV.

rdevsrex 8y ago

I use PHP everyday and it rocks for what it does when you use it with best practices. The real problem is with small companies who won’t or don’t upgrade their infrastructure on a regular basis. Heck, even with Wordpress these days you could use it as an API source and build a modern SPA website. It’s just getting over the inertia of intransigent stakeholders.

4FNET7 8y ago

What about PHP RoadRunner, PHP Swoole, ReactPHP, ... ?

bufferoverflow 8y ago
I recently benchmarked Swoole. It's insanely fast compared to regular PHP. It's currently taking #4 place in the famous framework benchmark: https://www.techempower.com/benchmarks/ https://www.techempower.com/benchmarks/
osrec 8y ago
Swoole is awesome. We use it in production as does tencent. Documentation needs a bit of work though.

casper345 8y ago

Recent (funny) Observation, I hear more non-programmers trash PHP than actual programmers

mywittyname 8y ago
Young programmers too. I guess it's like how people trashed COBOL and Fortran when I was getting into development. Then later in life, I come to find out that Fortran is ubiquitous in engineering and is actually amazing for what it does.

combatentropy 8y ago

I prefer PHP but as glue. Like my first-grade teacher taught us, a drop of glue goes a long way. Too much glue makes a mess. Unlike many programmers, I don't pick one of the Turing-complete programming languages (PHP, Python, Ruby, Go, whatever) and try to write as much of my app as possible in it. Because they are Turing complete, you really can write everything in it. Because you can learn only so much, you are tempted to write more than you should in that language. But like I said, PHP is just a part of my stack, and I try my best to make it one of the thinnest layers. The other parts are Postgres, Apache, and the user's browser. I try to use each of those as much as possible. The server operating system also plays a part, and I suppose my stack includes Bash. Basically I try to do as much business logic as possible in Postgres. This leaves PHP to do little more than glue the output of Postgres to HTML templates.

sebastianavina 8y ago
I prefer PHP as a whore. Because we all abuse it, and is damn easy to make it work. But at the end, we all feel dirty for using php.