4 ms·
> [Embedding PHP in HTML] obviously has maintainability and security issues. Honestly, I'm not sure it does. The two main security issues in typical PHP softwa
by csande17 7y ago
> [Embedding PHP in HTML] obviously has maintainability and security issues.
Honestly, I'm not sure it does. The two main security issues in typical PHP software are cross-site scripting and SQL injection, and both of those could be solved with better API design. (For example, PHP could use something similar to Rails's `html_safe` to make it harder to accidentally include untrusted HTML in the page.)
As far as maintainability goes, I'm not sure what makes PHP uniquely bad in this area. It seems like you could write a bad, unmaintainable React app in pretty much the same way you write a bad PHP app -- by eschewing MVC and sticking everything in the components/templates.
- codesushi42 7y agoHonestly, I'm not sure it does. Of course it does. Less maintainable code is always less secure. Embedding PHP business logic in HTML makes it much easier to accidentally dump confidential state into the response. Sticking everything into a component does not completely eschew MVC. You are still forced to bind values to a template. Mixing PHP and HTML without a template engine provides no guarantees. The responses here from PHP devs reaffirm my beliefs about how haphazard and sloppy PHP devs are.
- debaserab2 7y ago> Embedding PHP business logic in HTML makes it much easier to accidentally dump confidential state into the response. There's no reason confidential state will get dumped into the response unless your PHP settings are completely misconfigured. There was a time when PHP had very insecure defaults and that sort of thing would happen regularly especially in shared hosting environments where you had limited control over the configuration. That was a long time ago. I haven't worked on a PHP project in about 5 years, but I have seen well maintained PHP code. There's a lot of reasons to gripe about the language but this isn't one of them.
- codesushi42 7y agoWrong. Other languages require templating systems that won't allow you to dump variables because they won't be in scope in the first place. Using PHP in HTML allows you to do just that.
- debaserab2 7y agoUh, no - templates are scoped to the function or method in which they are called. They are only global if you include the template globally. class MyTemplate { function displayTemplate() { include 'mytemplate.php'; // mytemplate.php has access to only class properties. // Anything declared within mytemplate.php is scoped to the displayTemplate function. } }
- codesushi42 7y agoUh, that is a contrived example not suggested by the op. You can still embed PHP into HTML.
- debaserab2 7y agoUsing class methods to scope template variables is contrived? Huh?
- codesushi42 7y agoYou can still embed PHP into HTML.
- csande17 7y ago> Other languages require templating systems that won't allow you to dump variables because they won't be in scope in the first place. This isn't true of every templating system in popular use. Rails's Action View, if I recall, allows you to stick <%= ENV["THE_DATABASE_PASSWORD"] %> into a template with no fuss at all, and yet Rails developers somehow manage to avoid doing that. PHP isn't bad because it lets you put code in HTML, it's bad because the default behaviors and APIs it provides make it easy to shoot yourself in the foot. A better, safer language could keep PHP's ease of deployment without its issues. Maybe P++ will be that language and maybe it won't.