4 ms·

While Vanilla-PHP was definitely mostly just doing text substitution and had injection issues, there were other languages and template engines that were able to

by ratww 4y ago

While Vanilla-PHP was definitely mostly just doing text substitution and had injection issues, there were other languages and template engines that were able to fix this by having more sensible defaults where raw-html interpolation is not a default. Also, keep in mind that injection attacks are definitely still possible with modern frameworks. The same old techniques apply when you're dealing with data originating from users. Sure, the raw-html interpolation is not a default anymore, but like I said that's also present in old backend tech.

mypalmike 4y ago
The comparison I am responding to is original PHP ("30 years ago", which itself is garbage of course, given the language did not exist 30 years ago), not the new goalposts you have planted.
- ratww 4y ago
  I'm not disputing anywhere that the original PHP has issues, and in fact I'm acknowledging that in the beginning of the first paragraph. Adding additional information and context is not moving goalposts. What I'm actually reacting to is the rude provocation at the second paragraph that grandparent must "Look at the actual tech here. Do a tutorial. Discover what the difference is". They probably don't have to, because this specific advantage is not novel. ...not that this deserved any answer, considering the original reply is now flagged/dead. Maybe someone should tell you to check the website guidelines.
  - mypalmike 4y ago
    My reply was not intended to be rude or provocative. "We did this ages ago" is said so often, rudely and in ignorance, as it was here. And while there are often parallels to support the claim, the important distinctions are missed in ways that are best taught with hands on experience. Hence the suggestion to actually learn the new tools. If course, this is arguing in the internet with a curmudgeon, which I should not have bothered doing. I just don't want to see hn become slashdot, where this poo pooing of new tech happened in every thread.

by ratww 4y ago

mypalmike 4y ago

The comparison I am responding to is original PHP ("30 years ago", which itself is garbage of course, given the language did not exist 30 years ago), not the new goalposts you have planted.

ratww 4y ago
I'm not disputing anywhere that the original PHP has issues, and in fact I'm acknowledging that in the beginning of the first paragraph. Adding additional information and context is not moving goalposts. What I'm actually reacting to is the rude provocation at the second paragraph that grandparent must "Look at the actual tech here. Do a tutorial. Discover what the difference is". They probably don't have to, because this specific advantage is not novel. ...not that this deserved any answer, considering the original reply is now flagged/dead. Maybe someone should tell you to check the website guidelines.
- mypalmike 4y ago
  My reply was not intended to be rude or provocative. "We did this ages ago" is said so often, rudely and in ignorance, as it was here. And while there are often parallels to support the claim, the important distinctions are missed in ways that are best taught with hands on experience. Hence the suggestion to actually learn the new tools. If course, this is arguing in the internet with a curmudgeon, which I should not have bothered doing. I just don't want to see hn become slashdot, where this poo pooing of new tech happened in every thread.