4 ms·
I think if you're going to make a statement like that you need to be prepared to provide an argument to back that up. Ten years ago if you had told me we'd be
by debaserab2 7y ago
I think if you're going to make a statement like that you need to be prepared to provide an argument to back that up.
Ten years ago if you had told me we'd be interpolating HTML into javascript I might have said the same thing, yet here we are with React/JSX. It's not only common, it's generally regarded as good engineering.
- codesushi42 7y agoA terrible and incorrect comparison. JSX is a templating language. Your logic still lives within a JS component. Op is proposing that PHP be embedded directly in HTML. That obviously has maintainability and security issues. WordPress is a good example.
- csande17 7y ago> [Embedding PHP in HTML] obviously has maintainability and security issues. Honestly, I'm not sure it does. The two main security issues in typical PHP software are cross-site scripting and SQL injection, and both of those could be solved with better API design. (For example, PHP could use something similar to Rails's `html_safe` to make it harder to accidentally include untrusted HTML in the page.) As far as maintainability goes, I'm not sure what makes PHP uniquely bad in this area. It seems like you could write a bad, unmaintainable React app in pretty much the same way you write a bad PHP app -- by eschewing MVC and sticking everything in the components/templates.
- codesushi42 7y agoHonestly, I'm not sure it does. Of course it does. Less maintainable code is always less secure. Embedding PHP business logic in HTML makes it much easier to accidentally dump confidential state into the response. Sticking everything into a component does not completely eschew MVC. You are still forced to bind values to a template. Mixing PHP and HTML without a template engine provides no guarantees. The responses here from PHP devs reaffirm my beliefs about how haphazard and sloppy PHP devs are.
- debaserab2 7y ago> Embedding PHP business logic in HTML makes it much easier to accidentally dump confidential state into the response. There's no reason confidential state will get dumped into the response unless your PHP settings are completely misconfigured. There was a time when PHP had very insecure defaults and that sort of thing would happen regularly especially in shared hosting environments where you had limited control over the configuration. That was a long time ago. I haven't worked on a PHP project in about 5 years, but I have seen well maintained PHP code. There's a lot of reasons to gripe about the language but this isn't one of them.
- codesushi42 7y agoWrong. Other languages require templating systems that won't allow you to dump variables because they won't be in scope in the first place. Using PHP in HTML allows you to do just that.
- debaserab2 7y agoUh, no - templates are scoped to the function or method in which they are called. They are only global if you include the template globally. class MyTemplate { function displayTemplate() { include 'mytemplate.php'; // mytemplate.php has access to only class properties. // Anything declared within mytemplate.php is scoped to the displayTemplate function. } }
- codesushi42 7y agoUh, that is a contrived example not suggested by the op. You can still embed PHP into HTML.
- debaserab2 7y agoUsing class methods to scope template variables is contrived? Huh?
- debaserab2 7y agoPHP was originally invented to be a templating language. Your templating logic can still reside in a PHP file, function, or class, the same way it can in javascript with JSX. WordPress isn't bad because it uses PHP as a templating language (I think it's just the go-to "bad PHP codebase" example people use without really understanding why they are citing it). It's bad because it has competing code patterns that it evolved over time because it has to maintain backwards compatibility with an entire plugin ecosystem that is now decades old.
- codesushi42 7y agoThat is not true. I had to work with WordPress years ago, and one of the reasons it was so terrible is that it went to great lengths to mix view and business logic by interspersing PHP with HTML all over the place.
- debaserab2 7y agoYet React projects mix view and business logic by design and aren't usually that confusing to make changes to. That's not the reason the WP codebase is bad.
- codesushi42 7y agoMVC does not mix view and business logic.
- debaserab2 7y agoReact isn't MVC.
- codesushi42 7y agoReact is MVVM, a variant of MVC. React does not mix business logic and view logic in the same scope.
- jsjohnst 7y ago> JSX is a templating language. So is PHP.