7 ms·
PHP is a very good choice. If you want to refresh your knowledge of PHP take a look here: https://phptherightway.com/ https://phptherightway.com/ It's fast. PH
by Isinlor 7y ago
PHP is a very good choice. If you want to refresh your knowledge of PHP take a look here: https://phptherightway.com/ https://phptherightway.com/
It's fast. PHP has great documentation. PHP ecosystem is now based around Composer, in comparison to mess of package management in JavaScript and Python, Composer is just wonderful to use. Packagist has ton of libraries. Share nothing architecture is very easy to maintain and scale. You can do strict typing. There are static code analysis libraries like Psalm and PHPStan if you want features normally offered by compilers. It's easy to hire devs. There are two wonderful frameworks that moder PHP is centered around: Laravel and Symfony. There is also community body issuing standards to ease framework interoperability: https://www.php-fig.org/psr/ https://www.php-fig.org/psr/
The app seems to be written in Laravel, so you can take a look here if it's your coup of tea: https://laravel.com/ https://laravel.com/
Having said that, Wordpress and other old code bases are still a mess. But stable mess, and business like stable :) .
- LeifCarrotson 7y agoThe hazard is that it was such a big mess in the past that if you want to hire someone to work on your self-hosted app, there are going to be a lot of applicants who want to use PHP the wrong way.
- smacktoward 7y agoSo use PHPTheRightWay to come up with some interview questions to filter those folks out. Problem solved!
- theamk 7y agoI did a quick look through PhpTheRightWay website, and I saw no mention of the advice that php user should have no permissions to change app code -- or in other words, that "deploy" and "run" users should be different. Is this the recommended practice now? Because that was the main reason to avoid PHP codebases for me. Having an app where any code execution bug instantly leads to permanent compromise scares me deeply.
- Isinlor 7y agoPHP was never receiving requests directly from the Internet. It was always a standard practice to talk to PHP trough a server. The separation between what you call deploy and run user is what you get as default by using Nginx or Apache on Ubuntu (root vs. www-data). If you feel very paranoid and don't mind some complexity you can put PHP code into a docker container and run it from there. In that setup, attacker targeting PHP code would need to break out of docker container to take full control over the server.
- theamk 7y agoThat sounds nice -- but does this happens often in PHP world? Last PHP project I tried to install was OwnCloud, and it explicitly says (in [0]): > Your HTTP user must own the config/, data/, apps/ respectively the apps-external/ directories so that you can configure ownCloud, create, modify and delete your data files, and install apps via the ownCloud Web interface. [0] https://doc.owncloud.org/server/10.4/admin_manual/installation/installation_wizard.html#post-installation-steps https://doc.owncloud.org/server/10.4/admin_manual/installati...
- Isinlor 7y agoA lot of PHP apps allow you to install plugins from within the app itself, without going trough the whole process of deployment. The app has to modify it's own code in that scenario. This is independent from programming language. If you allow users to independently install plugins you will allow them to execute third-party code - it's true for all programming languages. I don't know ownCloud, but I would guess they have an option to disable plugin installation. And as I said, if you feel paranoid, you can install PHP apps in docker container: https://doc.owncloud.org/server/10.4/admin_manual/installation/docker/ https://doc.owncloud.org/server/10.4/admin_manual/installati...