6 ms·
I have written PHP for a living for the last 20 years and that eval just pains me to no end eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";'); Wh
by donatj 2y ago
I have written PHP for a living for the last 20 years and that eval just pains me to no end
eval($var . '="' . str_replace('"', '\\\\"', $itm) . '";');
Why? Dear god why. Please stop.
PHP provides a built in escaper for this purpose
eval($var . '=' . var_export($itm, true) . ';');
But even then you don't need eval here!
${$var} = $itm;
Is all you really needed... but really just use an array(map) if you want dynamic keys... don't use dynamically defined variables...
- zoover2020 2y agoThis is why PHP is mostly banned at bigCo
- NovemberWhiskey 2y agoTo paraphrase: you can write PHP in any language. PHP is a negative bias for bigCo mostly because of the folkloric history of bad security practices by some PHP software developers.
- jeremyjh 2y agoBy “folkloric history”, don’t you actually mean just “history”?
- playingalong 2y agoI guess they mean the stigma that arose based on the reality in the past. So kind of both.
- hinkley 2y agoThey fucked themselves and the rest of us moved on. You can become a good person late in life and still be lonely because all your bridges are burned to the ground.
- hinkley 2y ago> folkloric I think the word you’re looking for is “epic” or “legendary”
- phplovesong 2y agoPretty much. PHP for a banking software? For anything money related? Goomg to have a bad time.
- smashed 2y agoMagento, OpenCart or WooCommerce are money related. All terrible but also very popular. But I guess they work, somehow. What would you use to build and self-host an ecommerce site quickly and that is not a SaaS?
- rafark 2y agoHave you ever heard of WooCommerce? It’s the market leader. It powers more stores than Shopify.
- dartos 2y agoIsn’t Facebook one of the biggest?
- packetslave 2y agoHack is not PHP (any longer)
- smsm42 2y agoYou're saying all big companies ban whole language ecosystem because somebody on the internet used one function in that language in knowingly unsafe manner contrary to all established practices and warnings in the documentation? This is beyond laughable.
- dr_kretyn 2y agoPretty sure there's plenty of PHP at Amazon and Facebook (just with slightly different names)
- jonhohle 2y agoThere is no PHP at Amazon (at least not 2009-2016). It was evaluated before my time there and Perl Mason was chosen instead to replace C++. A bunch if that’s still appears to exist (many paths that start with gp/) but a lot was being rebuilt in various internal Java frameworks. I know AWS had some rails apps that were being migrated to Java a decade ago, but I don’t think I ever encountered PHP (and I came in as a programmer primarily writing PHP).
- dr_kretyn 2y agoOk, my "pretty sure" turns out to be "not sure at all". Thank you for the refresher! I was thinking about Mason and somehow conflated Perl with PHP. I left Amazon 2020. Had various collaborations with ecommerce (mainly around fulfillment) and there was plenty of Mason around.
- jonhohle 2y agoI was probably one of the few who enjoyed Mason and still think the aggregator framework was great. We implemented a work-a-like in Java on Prime and it worked great there as well. It was effectively GraphQL before GraphQL, but local and remote, async, polymorphic, and extremely flexible. Not being in that world anymore I’m not sure if there is anything else quite like it, but there really should be.
- joeframbach 2y agoI can *assure* you that php is expressly prohibited for use at Amazon.
- johnisgood 2y agoReally? How come? What is the history with regarding to that? What are their reasoning? Does it apply to PHP >=8?
- xp84 2y agoI mean no disrespect to you, but this sort of thing is exactly the sort of mess I’ve come to expect in any randomly-selected bit of PHP code found in the wild. It’s not that PHP somehow makes people write terrible code, I think it’s just the fact that it’s been out for so long and so many people have taken a crack at learning it. Plus, it seems that a lot of ingrained habits began back when PHP didn’t have many of its newer features and they just carried on, echoing through stack overflow posts forever.
- dartos 2y agoJavaScript land fares little better. IMO it’s because php and js are so easy to pick up for new programmers. They are very forgiving, and that leads to… well… the way that php and js is…
- awesomeMilou 2y agoI'm sorry, I haven't encountered bare eval in years. Do you have an example? And even then it's actually not that easy to get RCE going with that.
- donatj 2y agoSomething like half of of reported JavaScript vulnerabilities are "prototype pollution" because It's very common practice to write to object keys blindly, using objects as a dictionary, without considering the implications. It's a very similar exploit.
- baq 2y agoarguably worse, since no eval is needed...
- johnisgood 2y agoYeah, same with the use of "filter_input_array", "htmlspecialchars", or how you should use PDO and prepare your statements with parameterized queries to prevent SQL injection, etc.
- dustywusty 2y agoCouldn't agree more with this. In general, if you're writing eval you've already committed to doing something the wrong way.
- deleted 2y ago[deleted]