7 ms·
PHP Is Web Shell
- skilled 3y agoThe good old days of dropping a c99/r57 on a website and enjoying being a god over the entire server.
- oldandboring 3y agoI get that "web shell" in script-kiddie land has a specific meaning, but that is not what the author is talking about. They're just talking about how PHP, for many seasoned engineers, functions as a quick-and-dirty tool for getting things done and running quickly, much in the same way that shell scripting does for Linux ops.
- skilled 3y agoRight…
- chrsig 3y agoI don't know if I'd call it a "web shell", or what that would really mean. It's a dsl for content generation that got not enough up front thought followed by an unreasonable time and human suffering investment. It's in a better situation now than it was. I hope.
- s1k3s 3y agoYou can write crap in any language. Or at least I can.
- 29athrowaway 3y agoPHP is a scripting language and so is Bash. Both focus in different use cases. The observation "PHP is web shell" does not seem very insightful or interesting.
- gjsman-1000 3y agoThe Silicon Valley / Hacker News Paradox: ~80%-90% of companies in this world are still using PHP, Perl, Bash, COBOL, Fortran, and C - all without fuzzers, automatic testing, or CI/CD. There's also no shortage of Bootstrap, XML, jQuery, jQuery UI, and pre-HTML pages in this world. (Heck, macOS still ships XHTML 4.01 pages as part of the Screen Time system, right now.) You also seriously do not want to examine how much stuff which still relies on Internet Explorer is out there in corporate IT - there's a reason why Microsoft kept it for so long and still has IE Mode in Edge. We can't all be elitists and chronological snobs enjoying Rust, Ruby, and Node and bragging about how this is the only good or practical way to do things.
- oldandboring 3y agoYup. There's also a ton of legacy Java and ASP/.NET stuff out there in my experience.
- waldrews 3y agoCan't really speak to Java, but ASP.Net, in its new open-source friendly incarnation, is perfectly viable for modern development (and there's still nothing quite like Blazor Server). They have a good story for integrating the new stuff (e.g. Razor Pages) with legacy code, interop and drivers for everything, the CLR is fast and multithreaded (cough Python cough), and F# is available for us language snobs. Just avoid the enterprise cruft and the Azure cost (and complexity) premium.
- internetter 3y agoI had a kneejerk reaction to this — no way 90% of companies use this! But you could be right. I mean, 43% of the web is wordpress
- gjsman-1000 3y ago43% of the web is WordPress. PHP, which WordPress is built on, is on somewhere between 70%-80% of websites in total. Websites you may not expect, like Wikipedia, Facebook (with a modified dialect), Etsy, and Slack have large PHP Codebases. As well as the 11th and 15th most visited websites in the world which are almost entirely PHP but, em, NSFW [1]. COBOL is still running every major bank, right now, as well as the IRS. Visa and MasterCard are still running on their IBM Z mainframes. Heck, not even DOS is gone. I've seen updated DOS programs running the registers at McDonalds in my area. Our midwestern regional hardware store brand (Menards) openly uses DOS programs at almost all of the employee kiosks for looking up information. Don't believe me? Here's a reddit thread about someone criticizing replacing System V at that hardware store branch (which covers MN, WI, and Iowa). https://www.reddit.com/r/menards/comments/t5czy3/system_vi/ https://www.reddit.com/r/menards/comments/t5czy3/system_vi/ and https://www.reddit.com/r/menards/comments/11lb6pf/there_is_a_secret_way_to_access_system_v_hehe/ https://www.reddit.com/r/menards/comments/11lb6pf/there_is_a... [1] Anyone who says PHP doesn't scale - point to, well, any porn site, as well as Wikipedia and Etsy, and you'll have proof it's completely BS.
- Retr0id 3y agoTook me a moment to understand they mean "shell scripting language for the web", as opposed to "webshell" as in remote command execution interface. https://en.wikipedia.org/wiki/Web_shell https://en.wikipedia.org/wiki/Web_shell
- phoe-krk 3y agoIn surprisingly many cases, PHP is a web shell and a webshell at the same time.
- gmuslera 3y agoIt should not be very surprising considering the amount of vulnerability scans that have all internet exposed sites for several php applications and related patterns. It have the other kind of rot, if it was sitting there for long enough time without updates probably it is used by bad actors.
- Retr0id 3y agoNope. The incidence of vulns in freshly written vanilla PHP is higher than any other web-dev language I've seen. The reputation is deserved, and existed since before it stopped being a trendy language. Skilled PHP devs know to avoid the footguns, but that doesn't mean they aren't there.
- gjsman-1000 3y agoMeh, JavaScript has a completely different footgun: Pulling in third-party dependencies for even basic tasks; hundreds of them for even a simple application. You've replaced the risks in the language itself, with increased risk of supply chain attacks.
- louwrentius 3y agoThe point the post makes is valid, trusted, tried and true boring solutions do one thing very well: they are reliable, they work, they ship. But there's a different take: I've written a lot of bash shell in my life, but at some point I quit and moved over to Python. Having a decent programming language makes building any kind of workflow so much better, easier, prettier, more readable. Anything beyond 10-20 lines becomes Python. Every single time I think 'nah, bash is good enough' I come to regret it. I wonder if and what the equivalent analogy with PHP is.... ;-)
- internetter 3y agoThe problem I keep hitting is that the standard library of <language> is frequently not as strong as GNU, so then I install a bunch of packages globally and its a mess. Edit: I think there's room for a language with modern control flow that just wraps bash. Like if (true) { cat("path") }
- louwrentius 3y agoA virtual env works fine for this, there's no real reason not to use then in my view.
- internetter 3y agoBut that's a lot more work than a simple bash script
- louwrentius 3y agoPython -m venv dirname . dirname/bin/activate I beg to differ
- Retr0id 3y agoThe boilerplate can be a bit ugly, but you can invoke CLI tools from python just fine. The result is not particularly "pythonic" but I think it beats a pure bash script if there's non-trivial business logic.
- deleted 3y ago[deleted]
- tambourine_man 3y ago> That pink stuff… If the author means the logo, they should schedule an optometrist visit
- xnx 3y agoJavaScript and PHP are probably the 2 most unfortunately successful web languages. Things would've been very different if TCL was the language in Netscape and mod_tcl was shipped with Apache and part of the standard install for web hosts.
- RobertWHurst 3y agoI think that's a bit silly to say. We don't know how the web would have evolved without these languages, but it's pretty evident that modern web development has had some sizable influences on programming in general, and it wouldn't have happened without it's humble beginnings. I also suggest both languages have evolved quite a bit since. Between these, though, I think modern JS has had the most impact. This can mostly be attributed to the node community, with a great deal of insights from ruby. Things like async patterns and quality package management have changed our standards for what we expect out of modern languages, despite the coerson based parlor tricks chuckled at by those who don't use the language. PHP, on the other hand, is still a templating language that lives and dies in a request response cycle.
- xnx 3y agoThe evolution of JavaScript has been astounding. It's just a shame we didn't begin from a slightly better starting point.
- racked 3y agoThe article needs some examples. I wouldn't call doing a curl call in PHP particularly comfortable. Not something I'd want in a shell. :-)
- trog 3y ago> The article needs some examples. I wouldn't call doing a curl call in PHP particularly comfortable. Not something I'd want in a shell. :-) There are a couple of other ways to make web calls in PHP that don't require curl (which I agree is a bit confusing if you're coming in cold - I've been doing it for decades and still have to look up the docs every single time). If I need to do a basic kinda GET request you can simply call file('https://example.com https://example.com') to pull in content from that URL. fopen() also supports URLs. I do this in shell scripts (and "web shell" as the author calls it) all the time.
- padde 3y agoHaha, true. I just recently wanted to make a quick and dirty page that would calculate the middle point of a bunch of coordinates and then show it on a map. After contemplating how to get started I remembered that the server is running mod_php. 10 mins later and the (ugly as heck) page was working. The map stuff was client-side JavaScript from GitHub, the coordinate calculation were less than a screen page of PHP (of which most was HTML and CSS).
- trog 3y agoI actually stopped using bash for shell scripting and started using PHP, probably about two decades ago. It's not for everyone - I never got fully fluent in bash, so find it a million times easier to write shell scripts in PHP, and can use a lot of the dev tools I would use in webdev.
- wink 3y agoThe only things they have in common is that they are easy to use and somewhat uniquitous. But then again you use shell because it works _everywhere_ and that is not true for PHP. PHP is evolving and unless you take some really old code and throw it in a new runtime, nope. People write PHP in the 2020s decidedly different than in the 2010 or 2000s. My bash scripts from this year are working on ancient RHEL machines. And overall I'd say it's very, very hard to write well-tested easy to maintain software of a certain size in bash, whereas in that regard PHP is just another regular programming language.
- sam_goody 3y agoPHP is reliable and sturdy. It's also really good. I have some experience with other languages. I cannot think of any other that is "better" in the same domain. (Bash or F# are "better" but in a different domain). Javascript has a lot of things I love, and I wish PHP would copy. But I rely on my Nginx/PHP pages more than on my Node/JS pages, and after a while I realized that PHP made better decisions, overall, for back-end. I have a love/hate relationship with Python (I like the indents; I don't like the virtual env, etc. unpopular views) but PHP is faster, has much more ready to work without hassle, and borks far less.