5 ms·

Rather than chasing MVw or OO trends of the JavaScript ecosystem and become more like JavaScript or Java, so to say, why don't the PHP developers identify and b

Rather than chasing MVw or OO trends of the JavaScript ecosystem and become more like JavaScript or Java, so to say, why don't the PHP developers identify and build on the unique strengths of PHP? Which are IMO: the large installed base in classic web hosting, and the original purpose of PHP as a high-level scripting language embedded in otherwise static HTML as in "<?php ...>". There is a huge room for improvement there since PHP's quick-and-dirty hackjob of a page-embedded language isn't HTML-aware and thus prone to injection attacks, which has caused uncountable attacks, botnets, and other problems for PHP and non-PHP sites alike, in particular when coupled with PHP's target demographic. This is especially painful because PHP embeds via SGML mechanisms (processing instructions), when SGML has all the features needed for context-aware, injection-free templating. If PHP can improve that story, and stop becoming the language of unintended consequences and usage-outside-its-comfort-zone, then it might earn a lot more respect and consideration.

simion314 8y ago
Your claims are vague, do you have a specific example of a new feature and a new mainstream framework that has the security issues you mention?
- ptx 8y ago
  I think the point is that if you use a "new mainstream framework", you lose the traditional unique strengths of PHP by using it essentially the same way as you would any other language, so you might as well use a different language. So instead of trying to be like other languages but with worse syntax and weird quirks, PHP could try to improve on the things that make it different and lead to its initial popularity.
  - tannhaeuser 8y ago
    Exactly my point. Thanks for explaining it much better than I could.
    - simion314 8y ago
      Your point as related to security, so mention what security problems are in modern PHP and frameworks.
  - simion314 8y ago
    The old security issues with PHP were if you used SQL strings queries without sanitizing user input, or using eval or a bad configured server where someone could upload a file and had it be executed. So you can use PHP without a framework, you need a good configured server, use the correct SQL related functions and practices. Example for a project you have a third party payment system that can send you a POST request when an event happens, you want to log this event in the database and maybe trigger a simple thing. I can(and done this) with just 1 PHP file, no third party dependencies and I did not had to install anything on the server(because PHP is already there) so no installing node,npm,npm packages maybe git . You will need a framework if you have a big project, you would be wasting a lot of time to do the logins, user management, view rendering from scratch and probably have a lot of bugs. There are minimalistic frameworks and libraries and you can use something that matches your need.
bayesian_horse 8y ago
I actually see no reason to use PHP over other languages except if the project already has a large codebase in PHP. In all other cases I keep thinking: "Have you seen Django yet?" And probably you can substitute ROR, Node, ASP.NET Core etc
Lazare 8y ago
> why don't the PHP developers identify and build on the unique strengths of PHP? Which are IMO: [...] the original purpose of PHP as a high-level scripting language embedded in otherwise static HTML as in "<?php ...>". I really don't think that's a strength of PHP. It's very bad at that, and that's not been a focus of the language for decades. PHP, even with the work you suggest, is always going to be inferior compared to something like Liquid, Jinja, or Twig. It's arguably true that PHP should focus on improving the things that make people use it, but nobody is using it because of that. Even the ability to run PHP on shared hosting is increasingly irrelevant as we move past that being a useful feature.
zanny 7y ago
If you want integrated scripting with web pages PHP cannot compete with the language already being embedded in pages to run on the client. The rise of Node et al was in large part the fall of PHP.

simion314 8y ago

Your claims are vague, do you have a specific example of a new feature and a new mainstream framework that has the security issues you mention?

ptx 8y ago
I think the point is that if you use a "new mainstream framework", you lose the traditional unique strengths of PHP by using it essentially the same way as you would any other language, so you might as well use a different language. So instead of trying to be like other languages but with worse syntax and weird quirks, PHP could try to improve on the things that make it different and lead to its initial popularity.
- tannhaeuser 8y ago
  Exactly my point. Thanks for explaining it much better than I could.
  - simion314 8y ago
    Your point as related to security, so mention what security problems are in modern PHP and frameworks.
- simion314 8y ago
  The old security issues with PHP were if you used SQL strings queries without sanitizing user input, or using eval or a bad configured server where someone could upload a file and had it be executed. So you can use PHP without a framework, you need a good configured server, use the correct SQL related functions and practices. Example for a project you have a third party payment system that can send you a POST request when an event happens, you want to log this event in the database and maybe trigger a simple thing. I can(and done this) with just 1 PHP file, no third party dependencies and I did not had to install anything on the server(because PHP is already there) so no installing node,npm,npm packages maybe git . You will need a framework if you have a big project, you would be wasting a lot of time to do the logins, user management, view rendering from scratch and probably have a lot of bugs. There are minimalistic frameworks and libraries and you can use something that matches your need.

bayesian_horse 8y ago

I actually see no reason to use PHP over other languages except if the project already has a large codebase in PHP. In all other cases I keep thinking: "Have you seen Django yet?" And probably you can substitute ROR, Node, ASP.NET Core etc

Lazare 8y ago

> why don't the PHP developers identify and build on the unique strengths of PHP? Which are IMO: [...] the original purpose of PHP as a high-level scripting language embedded in otherwise static HTML as in "<?php ...>". I really don't think that's a strength of PHP. It's very bad at that, and that's not been a focus of the language for decades. PHP, even with the work you suggest, is always going to be inferior compared to something like Liquid, Jinja, or Twig. It's arguably true that PHP should focus on improving the things that make people use it, but nobody is using it because of that. Even the ability to run PHP on shared hosting is increasingly irrelevant as we move past that being a useful feature.

zanny 7y ago

If you want integrated scripting with web pages PHP cannot compete with the language already being embedded in pages to run on the client. The rise of Node et al was in large part the fall of PHP.