5 ms·

Here before someone says that it's because MediaWiki is written in PHP.

by 256_ 7mo ago

Dwedit 7mo ago
PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-domain-admin-privileges-due-to-a-typo-dbf8773df767 https://danielc7.medium.com/remote-code-execution-gaining-do...
- m4tthumphrey 7mo ago
  Also the language that runs half of the web. Also the language that has made me millions over my career with no degree. Also the language that allows people to be up and running in seconds (with or without AI). I could go on.
  - jjice 7mo ago
    PHP is a fine language. It started my career. That said, it has a lot of baggage that can let you shoot yourself in the foot. Modern PHP is pretty awesome though.
    - radium3d 7mo ago
      Pretty sure we've seen people coding in essentially every other programming language also shoot themselves in the foot.
      - Sohcahtoa82 7mo ago
        Every language has foot-guns of some sort. The difference is how easy it is to accidentally pull the trigger. PHP makes it easy.
        radium3d 7mo ago
        Back in the day people were all about languages like C that made it incredibly easy too.
        Sohcahtoa82 7mo ago
        We didn't have anything better unless you wanted to take a massive performance hit and/or lose a ton of flexibility and capability.
      - jjice 7mo ago
        Yeah of course PHP isn't the only programming language you can write bugs in. I don't think you can make it impossible to shoot yourself in the foot, but PHP gives you more opportunities than some other languages, especially with older PHP standard library functions. One thing I particularly hate is when functions require calling another function afterwards to get any errors that happened, like `json_decode`. C has that problem too. Problems don't make it a _bad_ programming language. All languages have problems. PHP just has more than some other languages.
  - theamk 7mo ago
    Yep, that's the sad truth - a language popularity often has nothing to do with it's security properties. People will happily keep churning out insecure junk as long as it makes them millions, botnet and data compromises be damned.
  - ChrisMarshallNY 7mo ago
    I use it on the backends of my stuff. Works great, but, like any tool, usage matters. People who use tools badly, get bad results. I've always found the "Fishtank Graph" to be relevant: https://w3techs.com/technologies/history_overview/programming_language/ms/y https://w3techs.com/technologies/history_overview/programmin...
    - mannykannot 7mo ago
      People who use tools badly inflict bad results on other people, quite often far more so than they do so on themselves.
      - ChrisMarshallNY 7mo ago
        Yeah. It's funny how companies don't like to hire people that use tools correctly, but insist on creating tools that allow them to hire cheaper, less-qualified people. PHP works fine, if you're a halfway decent programmer. Same with C++.
  - onion2k 7mo ago
    Also the language that runs half of the web. The bottom half. ;)
  - ramon156 7mo ago
    The language is not what makes you nor the product. You could've written the same thing in RoR, PHP was just first and it's why it still exists
    - stackghost 7mo ago
      PHP performance is significantly better than Ruby on Rails, which I think plays a part in its continued popularity.
  - radium3d 7mo ago
    PHP is insanely great, and very fast. The hate has no clout.
  - dspillett 7mo ago
    > Also the language that has made me millions over my career with no degree. Well done. > Also the language that allows people to be up and running in seconds (with or without AI). People getting up and running without any opportunity to be taught about security concerns (even those as simple as the risks of inadequate input verification), especially considering the infamous inconsistency in PHP's APIs which can lead to significant foot-guns, is both a blessing and a curse… Essentially a pre-cursor to some of the crap that is starting to be published now via vibe-coding with little understanding.
  - deleted 7mo ago
    [deleted]
  - cwillu 7mo ago
    Try not to take criticisms of tools personally. Phillips head screws are shit for a great many applications, while simultaneously being involved in billions of dollars of economic activity, and being a driver that everyone has available.
  - jasonjayr 7mo ago
    Perl still runs the other half?
  - m4tthumphrey 7mo ago
    I can't edit nor be bothered to reply to all of the negative responses so I'll put it here. Pretty much all of you missed the larger point. PHP was what allowed me to not work in retail forever, buy a forever house, never have to worry about losing my job (this may change in the future with AI) or being at risk for redundancy, having chosen to only work for small, "normal" well run profitable businesses. Unless you're building a hyper scale product, it does the job perfectly. PHP itself is not a security issue; using it poorly is, and any language can be used poorly. PHP is still perfectly suitable for web dev, especially in 2026.
  - deleted 7mo ago
    [deleted]
  - msla 7mo ago
    > Also the language that has made me millions over my career with no degree. "You can't hate rum, it's made me so much money!"
- 420official 7mo ago
  FWIW this was fixed in 2020
  - dspillett 7mo ago
    I've not used PHP in anger in well over a decade, but if the general environment out there is anything like it was back then there are likely a lot of people, mostly on cheap shared hosting arrangements, running PHP versions older than that and for the most part knowing no better. That isn't the fault of the language of course, but a valid reason for some of the “ick” reaction some get when it is mentioned.
    - Joel_Mckay 7mo ago
      PHP had its issues like every language, but also a minimal memory footprint, XML/SOAP parser, and several SQL database cursor options. Most modern web languages like nodejs are far worse due to dependency rot, and poor REST design pattern implementations. =3
      - dspillett 7mo ago
        > languages like nodejs are far worse due to dependency rot Yep. Node-based projects sometimes get an “ick” reaction from me similar to PHP ones for that reason. In this case it also isn't really the languages fault, but the way people have built the ecosystem around it.
- ale42 7mo ago
  Except that in a contemporary PHP that doesn't work any more. PHP Warning: Uncaught Error: Undefined constant "flase" in php shell code:1 This means game over, the script stops there.
- deleted 7mo ago
  [deleted]

Here before someone says that it's because MediaWiki is written in PHP.

by 256_ 7mo ago

Here before someone says that it's because MediaWiki is written in PHP.

PHP is the language where "return flase" causes it to return true. https://danielc7.medium.com/remote-code-execution-gaining-domain-admin-privileges-due-to-a-typo-dbf8773df767 https://danielc7.medium.com/remote-code-execution-gaining-do...

m4tthumphrey 7mo ago
Also the language that runs half of the web. Also the language that has made me millions over my career with no degree. Also the language that allows people to be up and running in seconds (with or without AI). I could go on.
- jjice 7mo ago
  PHP is a fine language. It started my career. That said, it has a lot of baggage that can let you shoot yourself in the foot. Modern PHP is pretty awesome though.
  - radium3d 7mo ago
    Pretty sure we've seen people coding in essentially every other programming language also shoot themselves in the foot.
    - Sohcahtoa82 7mo ago
      Every language has foot-guns of some sort. The difference is how easy it is to accidentally pull the trigger. PHP makes it easy.
      - radium3d 7mo ago
        Back in the day people were all about languages like C that made it incredibly easy too.
        Sohcahtoa82 7mo ago
        We didn't have anything better unless you wanted to take a massive performance hit and/or lose a ton of flexibility and capability.
    - jjice 7mo ago
      Yeah of course PHP isn't the only programming language you can write bugs in. I don't think you can make it impossible to shoot yourself in the foot, but PHP gives you more opportunities than some other languages, especially with older PHP standard library functions. One thing I particularly hate is when functions require calling another function afterwards to get any errors that happened, like `json_decode`. C has that problem too. Problems don't make it a _bad_ programming language. All languages have problems. PHP just has more than some other languages.
- theamk 7mo ago
  Yep, that's the sad truth - a language popularity often has nothing to do with it's security properties. People will happily keep churning out insecure junk as long as it makes them millions, botnet and data compromises be damned.
- ChrisMarshallNY 7mo ago
  I use it on the backends of my stuff. Works great, but, like any tool, usage matters. People who use tools badly, get bad results. I've always found the "Fishtank Graph" to be relevant: https://w3techs.com/technologies/history_overview/programming_language/ms/y https://w3techs.com/technologies/history_overview/programmin...
  - mannykannot 7mo ago
    People who use tools badly inflict bad results on other people, quite often far more so than they do so on themselves.
    - ChrisMarshallNY 7mo ago
      Yeah. It's funny how companies don't like to hire people that use tools correctly, but insist on creating tools that allow them to hire cheaper, less-qualified people. PHP works fine, if you're a halfway decent programmer. Same with C++.
- onion2k 7mo ago
  Also the language that runs half of the web. The bottom half. ;)
- ramon156 7mo ago
  The language is not what makes you nor the product. You could've written the same thing in RoR, PHP was just first and it's why it still exists
  - stackghost 7mo ago
    PHP performance is significantly better than Ruby on Rails, which I think plays a part in its continued popularity.
- radium3d 7mo ago
  PHP is insanely great, and very fast. The hate has no clout.
- dspillett 7mo ago
  > Also the language that has made me millions over my career with no degree. Well done. > Also the language that allows people to be up and running in seconds (with or without AI). People getting up and running without any opportunity to be taught about security concerns (even those as simple as the risks of inadequate input verification), especially considering the infamous inconsistency in PHP's APIs which can lead to significant foot-guns, is both a blessing and a curse… Essentially a pre-cursor to some of the crap that is starting to be published now via vibe-coding with little understanding.
- deleted 7mo ago
  [deleted]
- cwillu 7mo ago
  Try not to take criticisms of tools personally. Phillips head screws are shit for a great many applications, while simultaneously being involved in billions of dollars of economic activity, and being a driver that everyone has available.
- jasonjayr 7mo ago
  Perl still runs the other half?
- m4tthumphrey 7mo ago
  I can't edit nor be bothered to reply to all of the negative responses so I'll put it here. Pretty much all of you missed the larger point. PHP was what allowed me to not work in retail forever, buy a forever house, never have to worry about losing my job (this may change in the future with AI) or being at risk for redundancy, having chosen to only work for small, "normal" well run profitable businesses. Unless you're building a hyper scale product, it does the job perfectly. PHP itself is not a security issue; using it poorly is, and any language can be used poorly. PHP is still perfectly suitable for web dev, especially in 2026.
- deleted 7mo ago
  [deleted]
- msla 7mo ago
  > Also the language that has made me millions over my career with no degree. "You can't hate rum, it's made me so much money!"
420official 7mo ago
FWIW this was fixed in 2020
- dspillett 7mo ago
  I've not used PHP in anger in well over a decade, but if the general environment out there is anything like it was back then there are likely a lot of people, mostly on cheap shared hosting arrangements, running PHP versions older than that and for the most part knowing no better. That isn't the fault of the language of course, but a valid reason for some of the “ick” reaction some get when it is mentioned.
  - Joel_Mckay 7mo ago
    PHP had its issues like every language, but also a minimal memory footprint, XML/SOAP parser, and several SQL database cursor options. Most modern web languages like nodejs are far worse due to dependency rot, and poor REST design pattern implementations. =3
    - dspillett 7mo ago
      > languages like nodejs are far worse due to dependency rot Yep. Node-based projects sometimes get an “ick” reaction from me similar to PHP ones for that reason. In this case it also isn't really the languages fault, but the way people have built the ecosystem around it.
ale42 7mo ago
Except that in a contemporary PHP that doesn't work any more. PHP Warning: Uncaught Error: Undefined constant "flase" in php shell code:1 This means game over, the script stops there.
deleted 7mo ago
[deleted]