6 ms·

PHP's hello world, for transmitting back to the user, is: <?php Print "Hello, World"; ?> I can wrap that in a little HTML, to get valid return to the user. I

PHP's hello world, for transmitting back to the user, is: <?php Print "Hello, World"; ?> I can wrap that in a little HTML, to get valid return to the user. I don't know what Node.js's hello world looks like. From google it looks like the following. This is a heck of a lot more things to understand. // Load the http module to create an http server. var http = require('http'); // Configure our HTTP server to respond with Hello World to all requests. var server = http.createServer(function (request, response) { response.writeHead(200, {"Content-Type": "text/plain"}); response.end("Hello World\n"); }); // Listen on port 8000, IP defaults to 127.0.0.1 server.listen(8000); // Put a friendly message on the terminal console.log("Server running at http://127.0.0.1:8000/ http://127.0.0.1:8000/);

_3u10 15y ago
Yes, PHP is awesome for building hello world applications. No one is disputing that. However, for building applications that might get deployed somewhere, or talk to a database in a secure fashion, it's a nightmare. For ruby, python and perl, it's just as easy to make a hello world like that, all you have to do is execute it as a CGI. Node.js is a FRAMEWORK, not a language, you can equally make it super simple to execute javascript the same way by again executing it at as CGI, it's actually even shorter because you don't need <? ?> tags. The reason the Perl,Python and Ruby communities don't make apps like that is because it's a bad idea. In ruby,perl,python,javascript if you really want to you can. PHP makes it incredibly hard to not be stupid in the way your app is setup. PHP saves you a few minutes of following a rails cast in exchange for a lifetime of hell. The crux of why most programmers disdain PHP is because of the poor choices for maintainability and ease of building larger applications, also because the PHP community has no idea what they're talking about for the most part. Most PHP programmers couldn't even tell the difference between a language, a framework, a template system, probably because PHP doesn't have any separation of concerns. The language, framework, standard library, templating system are all mashed into one godawful mess. But yes, it's really easy to build hello world applications. Alternatively, if you want to build a hello world application you could just write: Hello World in a text file and be done with it instead of exposing yourself to all the security vulnerabilities inherent in PHP. (Yes, even hello world is insecure in PHP)
- josegonzalez 15y ago
  Please explain to me how "hello world" is insecure in PHP. I am genuinely interested in your reasoning.
  - _3u10 15y ago
    PHP has had numerous security issues related to the parsing of things like HTTP headers, etc. This means that when you write your app in PHP, and do something simple you get security issues just for going along for the ride. Things like this: https://bugzilla.redhat.com/show_bug.cgi?id=786686 https://bugzilla.redhat.com/show_bug.cgi?id=786686 Put an empty PHP file on your server and you've got a vulnerability. If they can't figure out how to parse a URL correctly what else is lurking? Ironically, the issue is a fix for a DOS attack, so they traded a DOS attack for remote code exec, and then backported it. This is the equivalent of int main() { return 0; } having security issues. By the way, this issue is from two months ago, we're not even talking about the really bad ancient bugs.
- josegonzalez 15y ago
  Since I cannot reply to your response, I would like to inquire as to some resources where I can read more about the specific security bugs in PHP you are mentioning. I am well aware that PHP has had security issues in the past, but I am also aware of the fact that it gets a bad name because people read blog posts and then decide the sky is falling.
- maratd 15y ago
  > However, for building applications that might get deployed somewhere, or talk to a database in a secure fashion, it's a nightmare. In what decade? Ever heard of PDO? Prepared statements? PHP is actually more secure when it comes to database connections than all of the wonderful alternatives you mentioned.
  - briandear 15y ago
    More secure? Then I suppose I'll get all of the insurance and banking portals to rewrite everything in PHP -- since is so secure and easy to use.
Lazare 15y ago
Actually, you'd probably want Express. var app = express.createServer(); app.get('/', function(req, res){ res.send('Hello World'); }); app.listen(3000); That is, admittedly, longer than PHP but it's arguably easier to understand what's going on, much easier to modify and extend, and just as easy to copy and paste off the web. For Sinatra: require 'sinatra' get '/' do "Hello World!" end Again, does PHP have any real advantage here? Python solutions will be similar. And in all those cases we can turn this into a full app with only a few more lines. Consider this example of a completely function blog: https://github.com/mitsuhiko/flask/tree/master/examples/flaskr https://github.com/mitsuhiko/flask/tree/master/examples/flas... There's 76 sloc of code in the blog app, plus tests, templates, database access, and more. And it's clean, clear, and simple. What does the PHP equivalent look like? Of course, PHP is still shorter for hello world...mostly because it's running as a CGI app. This is a terrible, archaic idea for all the reasons that get discussed when people talk about Why PHP Is Terrible, but nothing is stopping you from configuring other languages that way. So here's a real apples-to-apples comparison: Python: print "Hello world!" Too long? Try Ruby: puts "Hello world!" 19 characters including white space? Beat that! :)
- CJefferson 15y ago
  Your examples are interesting, I may look at Sinatra and flask. One other big advantage of PHP, which I find as time goes by, is (boringly) its broad stability. I first learnt PHP over 10 years ago, and what I learnt then still works now. Web apps are a very small part of what I do, I knock together the odd small one every couple of years or so. I did do one app in Rails, but when I next came back to look at Rails about 18 months later, it seemed enough things had changed my app broke in various ways. I find I increasingly appreciate a large community, a book or two, and some stability. Obviously if your day-to-day life is web design that doesn't apply. My day-to-day life in high performance algorithms, and I was using new C++11 features as they got implemented in compilers, and have played with many languages in that area.
  - gauravk92 15y ago
    I'd love an experts opinion on c++11 in the realm of high performance algorithms. Considering most of the updates were instruction additions and fixes, is it really increasing speed and even worth it to use the bleeding edge for maybe some small gain where a 10 year old language is simply much more reliable? Also, I didn't mention the updates in parallelism that were added (because they should have come earlier)...but do you think c++ is comparable to a modern concurrent language atm? Worth it over erlang?
Jach 15y ago
Let's look at something trivially more complex than a Hello World: a form handler. The form is just HTML, asking for a name: <html> <body> <form action="handlerhere" method="post"> <label>Name: <input type="text" name="name" /></label> <input type="submit" name="submit" value="Submit" /> <input type="hidden" name="submitted" value="TRUE" /> </form> </body> </html> The handler is a separate file. This whole example is from back around my first year of programming, when (among other silly things) I thought indentation was stupid. (Which was one reason I didn't like Python to begin with even though I love it now.) The PHP handler: <html> <body> <?php if (isset($_POST['submitted'])) { $name = htmlentities(stripslashes($_POST['name'])); echo "<p>The submitted name was \"$name\"</p>"; } ?> </body> </html> And the Python version (notice the silly one space indent (I use two now!) and the silly semicolons): #!/usr/bin/python import cgi; def main(): form = cgi.FieldStorage(); # instantiate only once! name = form.getfirst('name', 'empty'); # Avoid script injection escaping the user input name = cgi.escape(name); print "Content-Type: text/html\n"; print """\ <html> <body> <p>The submitted name was "%s"</p> </body> </html>""" % name if __name__ == "__main__": main(); Oh, and with the Python version I had to add this file to the directory it was in which I didn't totally understand at the time: Options +ExecCGI AddHandler cgi-script .py Options +Indexes Admittedly not that hard. I had an .htaccess file already for fun 404 handlers. I vaguely remember being confused for a while because the .py script didn't have the right permissions on it so the server's apache just refused to execute. The complexity isn't that much different, it's just that Python provided no compelling reason for me to switch to it. (And, frankly, even with Flask still doesn't for simple single-file web-page scripts. Applications, on the other hand...)
jacobr 15y ago
What should I do with that PHP script alone? The same example in Node, with no web server, just like yours: console.log('Hello World')

_3u10 15y ago

Yes, PHP is awesome for building hello world applications. No one is disputing that. However, for building applications that might get deployed somewhere, or talk to a database in a secure fashion, it's a nightmare. For ruby, python and perl, it's just as easy to make a hello world like that, all you have to do is execute it as a CGI. Node.js is a FRAMEWORK, not a language, you can equally make it super simple to execute javascript the same way by again executing it at as CGI, it's actually even shorter because you don't need <? ?> tags. The reason the Perl,Python and Ruby communities don't make apps like that is because it's a bad idea. In ruby,perl,python,javascript if you really want to you can. PHP makes it incredibly hard to not be stupid in the way your app is setup. PHP saves you a few minutes of following a rails cast in exchange for a lifetime of hell. The crux of why most programmers disdain PHP is because of the poor choices for maintainability and ease of building larger applications, also because the PHP community has no idea what they're talking about for the most part. Most PHP programmers couldn't even tell the difference between a language, a framework, a template system, probably because PHP doesn't have any separation of concerns. The language, framework, standard library, templating system are all mashed into one godawful mess. But yes, it's really easy to build hello world applications. Alternatively, if you want to build a hello world application you could just write: Hello World in a text file and be done with it instead of exposing yourself to all the security vulnerabilities inherent in PHP. (Yes, even hello world is insecure in PHP)

josegonzalez 15y ago
Please explain to me how "hello world" is insecure in PHP. I am genuinely interested in your reasoning.
- _3u10 15y ago
  PHP has had numerous security issues related to the parsing of things like HTTP headers, etc. This means that when you write your app in PHP, and do something simple you get security issues just for going along for the ride. Things like this: https://bugzilla.redhat.com/show_bug.cgi?id=786686 https://bugzilla.redhat.com/show_bug.cgi?id=786686 Put an empty PHP file on your server and you've got a vulnerability. If they can't figure out how to parse a URL correctly what else is lurking? Ironically, the issue is a fix for a DOS attack, so they traded a DOS attack for remote code exec, and then backported it. This is the equivalent of int main() { return 0; } having security issues. By the way, this issue is from two months ago, we're not even talking about the really bad ancient bugs.
josegonzalez 15y ago
Since I cannot reply to your response, I would like to inquire as to some resources where I can read more about the specific security bugs in PHP you are mentioning. I am well aware that PHP has had security issues in the past, but I am also aware of the fact that it gets a bad name because people read blog posts and then decide the sky is falling.
maratd 15y ago
> However, for building applications that might get deployed somewhere, or talk to a database in a secure fashion, it's a nightmare. In what decade? Ever heard of PDO? Prepared statements? PHP is actually more secure when it comes to database connections than all of the wonderful alternatives you mentioned.
- briandear 15y ago
  More secure? Then I suppose I'll get all of the insurance and banking portals to rewrite everything in PHP -- since is so secure and easy to use.

Lazare 15y ago

Actually, you'd probably want Express. var app = express.createServer(); app.get('/', function(req, res){ res.send('Hello World'); }); app.listen(3000); That is, admittedly, longer than PHP but it's arguably easier to understand what's going on, much easier to modify and extend, and just as easy to copy and paste off the web. For Sinatra: require 'sinatra' get '/' do "Hello World!" end Again, does PHP have any real advantage here? Python solutions will be similar. And in all those cases we can turn this into a full app with only a few more lines. Consider this example of a completely function blog: https://github.com/mitsuhiko/flask/tree/master/examples/flaskr https://github.com/mitsuhiko/flask/tree/master/examples/flas... There's 76 sloc of code in the blog app, plus tests, templates, database access, and more. And it's clean, clear, and simple. What does the PHP equivalent look like? Of course, PHP is still shorter for hello world...mostly because it's running as a CGI app. This is a terrible, archaic idea for all the reasons that get discussed when people talk about Why PHP Is Terrible, but nothing is stopping you from configuring other languages that way. So here's a real apples-to-apples comparison: Python: print "Hello world!" Too long? Try Ruby: puts "Hello world!" 19 characters including white space? Beat that! :)

CJefferson 15y ago
Your examples are interesting, I may look at Sinatra and flask. One other big advantage of PHP, which I find as time goes by, is (boringly) its broad stability. I first learnt PHP over 10 years ago, and what I learnt then still works now. Web apps are a very small part of what I do, I knock together the odd small one every couple of years or so. I did do one app in Rails, but when I next came back to look at Rails about 18 months later, it seemed enough things had changed my app broke in various ways. I find I increasingly appreciate a large community, a book or two, and some stability. Obviously if your day-to-day life is web design that doesn't apply. My day-to-day life in high performance algorithms, and I was using new C++11 features as they got implemented in compilers, and have played with many languages in that area.
- gauravk92 15y ago
  I'd love an experts opinion on c++11 in the realm of high performance algorithms. Considering most of the updates were instruction additions and fixes, is it really increasing speed and even worth it to use the bleeding edge for maybe some small gain where a 10 year old language is simply much more reliable? Also, I didn't mention the updates in parallelism that were added (because they should have come earlier)...but do you think c++ is comparable to a modern concurrent language atm? Worth it over erlang?

Jach 15y ago

Let's look at something trivially more complex than a Hello World: a form handler. The form is just HTML, asking for a name: <html> <body> <form action="handlerhere" method="post"> <label>Name: <input type="text" name="name" /></label> <input type="submit" name="submit" value="Submit" /> <input type="hidden" name="submitted" value="TRUE" /> </form> </body> </html> The handler is a separate file. This whole example is from back around my first year of programming, when (among other silly things) I thought indentation was stupid. (Which was one reason I didn't like Python to begin with even though I love it now.) The PHP handler: <html> <body> <?php if (isset($_POST['submitted'])) { $name = htmlentities(stripslashes($_POST['name'])); echo "<p>The submitted name was \"$name\"</p>"; } ?> </body> </html> And the Python version (notice the silly one space indent (I use two now!) and the silly semicolons): #!/usr/bin/python import cgi; def main(): form = cgi.FieldStorage(); # instantiate only once! name = form.getfirst('name', 'empty'); # Avoid script injection escaping the user input name = cgi.escape(name); print "Content-Type: text/html\n"; print """\ <html> <body> <p>The submitted name was "%s"</p> </body> </html>""" % name if __name__ == "__main__": main(); Oh, and with the Python version I had to add this file to the directory it was in which I didn't totally understand at the time: Options +ExecCGI AddHandler cgi-script .py Options +Indexes Admittedly not that hard. I had an .htaccess file already for fun 404 handlers. I vaguely remember being confused for a while because the .py script didn't have the right permissions on it so the server's apache just refused to execute. The complexity isn't that much different, it's just that Python provided no compelling reason for me to switch to it. (And, frankly, even with Flask still doesn't for simple single-file web-page scripts. Applications, on the other hand...)

jacobr 15y ago

What should I do with that PHP script alone? The same example in Node, with no web server, just like yours: console.log('Hello World')