5 ms·

If you use any modern framework you're mostly covered. SQLi gets handled by ORM and XSS by the templating system which should be "secure" by default. SQLi has

If you use any modern framework you're mostly covered. SQLi gets handled by ORM and XSS by the templating system which should be "secure" by default. SQLi has been made harder to pull off in the language itself too as all DB queries run trough the PDO interface (for more than 10 years now, I think?). Oh and let's not forget the magic quotes... been gone for a very long time but I still get nightmares about that "feature". The problem used to be that PHP itself started as a templating language - you were supposed to mix HTML and PHP in one file. Easy to do and easy to make bugs. These days almost no one writes a large project without a decent framework. I'd say both the language and the ecosystem of libraries/frameworks have matured a lot over the years but you still have to follow best practices just like any other language. I highly doubt other languages are more "secure" by default.

tluyben2 6y ago
> you were supposed to mix HTML and PHP in one file. Easy to do and easy to make bugs. I maintain a large project (inherited) that has that; cannot say it's been that bad in my experience; it has been running for 20 years and used (internally and externally; it's a crm/erp/everything system) used by 1000s daily; no significant bugs have been reported and adding/changing features is fast and painless. I sometimes wonder if that over-architected stuff we have been taught really is much better. For most things here I change one (or 2) file, test, deploy, done. For most other stuff I maintain, for every change I have to change 5-10 files all over the place (service layers, data layers, migrations etc) and the result is not really better (I would say actually worse generally). It's not really apples vs apples (for starters, it is only used by this company and it's partners, while other systems are running publicly and have far more users and people trying to hack/break things) but this old system is causing me far less headaches than many others while it's far larger and more complex functionality wise. Edit: many companies came in 'offering' a rewrite but yeah.. This costs nothing to host and barely anything to maintain (compared to the revenue of the company) ; all other solutions or rewrites would cost a lot to create/set up and then a lot to run/maintain as well. It's a good example of a company that would be insane to 'go cloud'. Not many benefits but a nice bite in the profit.
- mekster 6y ago
  I don't think there's a good argument to justify mixing PHP and HTML... Unless you're on your own, how do designers touch the HTML without confronting some PHP code? Also, you should be using a better templating engine and it's not possible to do so if you mix HTML.
vbrandl 6y ago
I never used PHP so correct me if I'm missing something here, but "you need to use a framework to build good applications in PHP" (which kinda implies that it is hard/impossible otherwise) doesn't sound like an argument in favor of the language.
- ragnese 6y ago
  You're spot on. PHP is really bad, but zillions of hours have gone into tools around and on top of the language such that it's actually not that bad to develop in anymore. Why was all this time spent on PHP instead of doing anything else? I don't have a clue.
  - soulclap 6y ago
    That makes me wonder: why do you spend so many hours badmouthing PHP in multiple threads on here? Why isn't that time spent on something else?
    - ragnese 6y ago
      Being on Hacker News is leisure time. If you work on making PHP suck less purely for leisure, I reserve no judgement. If you are a Laravel author, my question stands.
      - wsatb 6y ago
        The answer is the same reason you build anything: there was a need for it, especially in the early 2010's for the language.
- cafard 6y ago
  I am not a PHP fan. However, in what language does one not use a framework to build applications?
  - capableweb 6y ago
    Many. Clojure/Script applications tends to favor your own composition of libraries rather than a full-fledged framework. Golang is (at least used to) the same as well.

tluyben2 6y ago

> you were supposed to mix HTML and PHP in one file. Easy to do and easy to make bugs. I maintain a large project (inherited) that has that; cannot say it's been that bad in my experience; it has been running for 20 years and used (internally and externally; it's a crm/erp/everything system) used by 1000s daily; no significant bugs have been reported and adding/changing features is fast and painless. I sometimes wonder if that over-architected stuff we have been taught really is much better. For most things here I change one (or 2) file, test, deploy, done. For most other stuff I maintain, for every change I have to change 5-10 files all over the place (service layers, data layers, migrations etc) and the result is not really better (I would say actually worse generally). It's not really apples vs apples (for starters, it is only used by this company and it's partners, while other systems are running publicly and have far more users and people trying to hack/break things) but this old system is causing me far less headaches than many others while it's far larger and more complex functionality wise. Edit: many companies came in 'offering' a rewrite but yeah.. This costs nothing to host and barely anything to maintain (compared to the revenue of the company) ; all other solutions or rewrites would cost a lot to create/set up and then a lot to run/maintain as well. It's a good example of a company that would be insane to 'go cloud'. Not many benefits but a nice bite in the profit.

mekster 6y ago
I don't think there's a good argument to justify mixing PHP and HTML... Unless you're on your own, how do designers touch the HTML without confronting some PHP code? Also, you should be using a better templating engine and it's not possible to do so if you mix HTML.

vbrandl 6y ago

I never used PHP so correct me if I'm missing something here, but "you need to use a framework to build good applications in PHP" (which kinda implies that it is hard/impossible otherwise) doesn't sound like an argument in favor of the language.

ragnese 6y ago
You're spot on. PHP is really bad, but zillions of hours have gone into tools around and on top of the language such that it's actually not that bad to develop in anymore. Why was all this time spent on PHP instead of doing anything else? I don't have a clue.
- soulclap 6y ago
  That makes me wonder: why do you spend so many hours badmouthing PHP in multiple threads on here? Why isn't that time spent on something else?
  - ragnese 6y ago
    Being on Hacker News is leisure time. If you work on making PHP suck less purely for leisure, I reserve no judgement. If you are a Laravel author, my question stands.
    - wsatb 6y ago
      The answer is the same reason you build anything: there was a need for it, especially in the early 2010's for the language.
cafard 6y ago
I am not a PHP fan. However, in what language does one not use a framework to build applications?
- capableweb 6y ago
  Many. Clojure/Script applications tends to favor your own composition of libraries rather than a full-fledged framework. Golang is (at least used to) the same as well.