4 ms·
It adds a lot of complexity to write performant code (you basically need another middle layer), yes. But it also has some security benefits - with that model i
by justapassenger 7y ago
It adds a lot of complexity to write performant code (you basically need another middle layer), yes.
But it also has some security benefits - with that model it’s harder to have exploits (as in your request you don’t carry over any other state), session swaps, no need to care about concurrency, locks, etc.
It’s by accident, but it’s a real benefit of php.
- stickfigure 7y agowith that model it’s harder to have exploits The PHP community's track record on security is abysmal compared to all those other environments that don't throw away the world.
- justapassenger 7y agoSecurity record is due to enormous popularity, low barrier to entry and some questionable/archaic design choices. But clean state at start of each request is clear security advantage. I can have a car with super safe airbags, that does horrible in crash tests. That doesn’t make those airbags bad.
- egeozcan 7y agoIt pushes people to find hacky solutions when they need "just this memoization for this simple use case" and years later when you take over the project you see it's been dumping request data to a publicly accessible folder. Luckily PHP is very damn fast so you don't see it often, but you'll start questioning the whole industry if you are hired as consultant into many middle-to-large-sized projects and see the hacks people have come up with.