3 ms·
> Embedding PHP business logic in HTML makes it much easier to accidentally dump confidential state into the response. There's no reason confidential state wil
by debaserab2 7y ago
> Embedding PHP business logic in HTML makes it much easier to accidentally dump confidential state into the response.
There's no reason confidential state will get dumped into the response unless your PHP settings are completely misconfigured.
There was a time when PHP had very insecure defaults and that sort of thing would happen regularly especially in shared hosting environments where you had limited control over the configuration. That was a long time ago.
I haven't worked on a PHP project in about 5 years, but I have seen well maintained PHP code. There's a lot of reasons to gripe about the language but this isn't one of them.
- codesushi42 7y agoWrong. Other languages require templating systems that won't allow you to dump variables because they won't be in scope in the first place. Using PHP in HTML allows you to do just that.
- debaserab2 7y agoUh, no - templates are scoped to the function or method in which they are called. They are only global if you include the template globally. class MyTemplate { function displayTemplate() { include 'mytemplate.php'; // mytemplate.php has access to only class properties. // Anything declared within mytemplate.php is scoped to the displayTemplate function. } }
- codesushi42 7y agoUh, that is a contrived example not suggested by the op. You can still embed PHP into HTML.
- debaserab2 7y agoUsing class methods to scope template variables is contrived? Huh?
- codesushi42 7y agoYou can still embed PHP into HTML.
- csande17 7y ago> Other languages require templating systems that won't allow you to dump variables because they won't be in scope in the first place. This isn't true of every templating system in popular use. Rails's Action View, if I recall, allows you to stick <%= ENV["THE_DATABASE_PASSWORD"] %> into a template with no fuss at all, and yet Rails developers somehow manage to avoid doing that. PHP isn't bad because it lets you put code in HTML, it's bad because the default behaviors and APIs it provides make it easy to shoot yourself in the foot. A better, safer language could keep PHP's ease of deployment without its issues. Maybe P++ will be that language and maybe it won't.
- codesushi42 7y agoThat's not the same. I have seen plenty of unmaintainable PHP code that embeds business logic in HTML.