3 ms·

I wrote php exclusively only for about two years early in my career but have had to come back to it periodically every once in a while. I find it one of the mos

I wrote php exclusively only for about two years early in my career but have had to come back to it periodically every once in a while. I find it one of the most difficult languages to be a visitor in. The way variable, array, and class semantics mix can make it hard to decipher the exact behavior of a chunk of code. Especially if you have a mix of "old" procedural and modern OO php, which the projects I work on do. I'm not bringing this up as a particular criticism of the language, I think it's fine. It is also an experience I have with lisp, where it is fun and easy to write but hard to read when coming back to it after a while away. I just don't think php is a simple language, on several levels. The semantics that I mentioned, combined with the mixing of paradigms, and the large and inconsistent standard library. You can write simple php but it takes a lot of discipline.

alt227 2y ago
> Especially if you have a mix of "old" procedural and modern OO php I guess thats a result of such wildly changing features in each version change. Each major version of PHP has brought in such drastic changes of concept and semantic that it is easy to start mixing them together and get confused looking code. However I find this in a lot of other systems. Look at node.js, every release changes things so much that people regularly rewrite their entire code base multiple times to take advantages of the new features. Do a google search for guides on node programming a specific issue, and depending on how old it is it you will get wildly differnt approches and results. Popular and highly developed languages change often, and this will always cause issues between old and new.
- giraffe_lady 2y ago
  I agree. I think for largely cultural and timing reasons, and also its success, there are a lot more long-lived php codebases for this to play out in compared to most languages. I also think possibly node is our generation's php, with it being so fast-changing and there not being a community consensus about framework. So every complex node project is, like pre-laravel php, essentially a totally unique ad-hoc framework composed of a mix of libraries. Ruby and python aren't better languages than php or node, and rails and django aren't perfect, but to a large extent those languages avoid this problem just because everyone is using the same solutions.
  - wbl 2y ago
    T_PAAMAYIM_NEKUDOTIM, mysql_real_es ape2, parse_str, etc.
    - duskwuff 2y ago
      > mysql_real_escape2 Blame MySQL for that name, not PHP. https://dev.mysql.com/doc/c-api/8.4/en/mysql-real-escape-string.html https://dev.mysql.com/doc/c-api/8.4/en/mysql-real-escape-str... (And, if you're doing modern PHP, it's just PDO->quote().)
      - munk-a 2y ago
        I'm not certain about OP's objection but for me it's less the function name and more the terrible history of how PHP tried to automatically fix SQL injection and instead made everything a thousand times worse. If you're not using bound parameters for user data you're taking a huge risk and making your life multitudes more difficult. PHP's PDO is by far the better option at this point but it suffers from poor enough usability that I've built my own wrapper for it at two different companies.
        hparadiz 2y ago
        Writing a wrapper for PDO is standard operating procedure for various good reasons.
        Dylan16807 2y ago
        > the terrible history of how PHP tried to automatically fix SQL injection and instead made everything a thousand times worse Are you thinking of stuff like magic quotes? mysql_real_escape is not part of an automatic anything. You manually use it to quote each value.
      - wbl 2y ago
        Why should I blame MySQL? It's the PHP developers that decided to introduce it and not change the name, plus have several functions that don't do the right thing as well.

alt227 2y ago

> Especially if you have a mix of "old" procedural and modern OO php I guess thats a result of such wildly changing features in each version change. Each major version of PHP has brought in such drastic changes of concept and semantic that it is easy to start mixing them together and get confused looking code. However I find this in a lot of other systems. Look at node.js, every release changes things so much that people regularly rewrite their entire code base multiple times to take advantages of the new features. Do a google search for guides on node programming a specific issue, and depending on how old it is it you will get wildly differnt approches and results. Popular and highly developed languages change often, and this will always cause issues between old and new.

giraffe_lady 2y ago
I agree. I think for largely cultural and timing reasons, and also its success, there are a lot more long-lived php codebases for this to play out in compared to most languages. I also think possibly node is our generation's php, with it being so fast-changing and there not being a community consensus about framework. So every complex node project is, like pre-laravel php, essentially a totally unique ad-hoc framework composed of a mix of libraries. Ruby and python aren't better languages than php or node, and rails and django aren't perfect, but to a large extent those languages avoid this problem just because everyone is using the same solutions.
- wbl 2y ago
  T_PAAMAYIM_NEKUDOTIM, mysql_real_es ape2, parse_str, etc.
  - duskwuff 2y ago
    > mysql_real_escape2 Blame MySQL for that name, not PHP. https://dev.mysql.com/doc/c-api/8.4/en/mysql-real-escape-string.html https://dev.mysql.com/doc/c-api/8.4/en/mysql-real-escape-str... (And, if you're doing modern PHP, it's just PDO->quote().)
    - munk-a 2y ago
      I'm not certain about OP's objection but for me it's less the function name and more the terrible history of how PHP tried to automatically fix SQL injection and instead made everything a thousand times worse. If you're not using bound parameters for user data you're taking a huge risk and making your life multitudes more difficult. PHP's PDO is by far the better option at this point but it suffers from poor enough usability that I've built my own wrapper for it at two different companies.
      - hparadiz 2y ago
        Writing a wrapper for PDO is standard operating procedure for various good reasons.
      - Dylan16807 2y ago
        > the terrible history of how PHP tried to automatically fix SQL injection and instead made everything a thousand times worse Are you thinking of stuff like magic quotes? mysql_real_escape is not part of an automatic anything. You manually use it to quote each value.
    - wbl 2y ago
      Why should I blame MySQL? It's the PHP developers that decided to introduce it and not change the name, plus have several functions that don't do the right thing as well.