3 ms·

I got into programming websites with PHP at a time when everyone was yelling Node for everything, JavaScript frameworks for everything, SPAs for everything. I

I got into programming websites with PHP at a time when everyone was yelling Node for everything, JavaScript frameworks for everything, SPAs for everything. I absolutely agree they have their place... but I don't have regrets. I'll get into JS Frameworks, Node, and all of that later as it never, ever hurts to broaden experience, but I have no regrets with jumping into PHP first because the productivity level is fantastic when tied to a framework to avoid the footguns. PHP has footguns, some infamous, but so does any framework or language.

ptx 4y ago
A template language that requires manually calling htmlspecialchars on every single value (or else you have an XSS vulnerability) seems like an enormous footgun. In Django this problem was corrected before the 1.0 release.
- wzy 4y ago
  Is this issue a footgun in Symfony, since you're comparing a framework of one language (Python) with a PHP language by itself?
- pjio 4y ago
  > ... when tied to a framework to avoid the footguns. Escaping is typically handled in the framework.
  - ptx 4y ago
    Oops, I missed that part when I read the comment I was replying to. Thanks.
- simion314 4y ago
  >Django You need to use a similar PHP framework, with one such framework you don't need to escape html or sql stuff.
- ipaddr 4y ago
  Are you talking about outputting unsafe user input? Laravel is the Django of the php world and does that out of the box. You could clean your user input before storing/displaying as best practice suggest.
- jbboehr 4y ago
  PHP isn't really used as a template language any more. Most people use a different template language for the views. I've implemented two myself[0][1] but an early one was Smarty[2] and there are many others. I hear Twig is pretty good[3]. [0]: https://github.com/jbboehr/php-handlebars https://github.com/jbboehr/php-handlebars [1]: https://github.com/jbboehr/php-mustache https://github.com/jbboehr/php-mustache [2]: https://www.smarty.net/ https://www.smarty.net/ [3]: https://twig.symfony.com/ https://twig.symfony.com/
  - ptx 4y ago
    If you're not using it as a template language though, why use PHP in the first place? Having to use a separate framework puts it on equal footing with every other language.
    - 8n4vidtmkvmk 4y ago
      it just works with no fuss. no compiling. no memory leaks because it dies after every request. the standard library, despite being horrifically inconsistent, has everything you need

ptx 4y ago

A template language that requires manually calling htmlspecialchars on every single value (or else you have an XSS vulnerability) seems like an enormous footgun. In Django this problem was corrected before the 1.0 release.

wzy 4y ago
Is this issue a footgun in Symfony, since you're comparing a framework of one language (Python) with a PHP language by itself?
pjio 4y ago
> ... when tied to a framework to avoid the footguns. Escaping is typically handled in the framework.
- ptx 4y ago
  Oops, I missed that part when I read the comment I was replying to. Thanks.
simion314 4y ago
>Django You need to use a similar PHP framework, with one such framework you don't need to escape html or sql stuff.
ipaddr 4y ago
Are you talking about outputting unsafe user input? Laravel is the Django of the php world and does that out of the box. You could clean your user input before storing/displaying as best practice suggest.
jbboehr 4y ago
PHP isn't really used as a template language any more. Most people use a different template language for the views. I've implemented two myself[0][1] but an early one was Smarty[2] and there are many others. I hear Twig is pretty good[3]. [0]: https://github.com/jbboehr/php-handlebars https://github.com/jbboehr/php-handlebars [1]: https://github.com/jbboehr/php-mustache https://github.com/jbboehr/php-mustache [2]: https://www.smarty.net/ https://www.smarty.net/ [3]: https://twig.symfony.com/ https://twig.symfony.com/
- ptx 4y ago
  If you're not using it as a template language though, why use PHP in the first place? Having to use a separate framework puts it on equal footing with every other language.
  - 8n4vidtmkvmk 4y ago
    it just works with no fuss. no compiling. no memory leaks because it dies after every request. the standard library, despite being horrifically inconsistent, has everything you need