5 ms·

I think in some cases, it would be better to explain why the PHP function was a bad idea to begin with, rather than letting people bring it's mess over to Pytho

I think in some cases, it would be better to explain why the PHP function was a bad idea to begin with, rather than letting people bring it's mess over to Python. For example, Python doesn't need dumb shit like nl2br() [1]. [1] http://www.php2python.com/wiki/function.nl2br/ http://www.php2python.com/wiki/function.nl2br/

carbocation 14y ago
I think that your idea is correct. I would rephrase it to say, "... explain why the PHP function does not belong in the language specification or the standard library to begin with..."
jiggy2011 14y ago
What's wrong with nl2br? Seems to do what it says on the tin.
- true_religion 14y ago
 Why do trivial functions have to be added to the language core?
 - jiggy2011 14y ago
 Why not? Most languages have a standard library that does all kinds of simple but useful stuff. PHP is aimed at the web so a function that deals with part of the web/non-web mismatch seems like a useful thing to include. Removing it would simply cause newbies to have to wrange with str_replace to build trivial web apps.
- madjar 14y ago
 Except the problem most people actually want to solve is not "convert newlines to ", it is "convert some text to html", and this function may lead to think that it does that, when it only does a tiny fraction of that. And that's how injections are born.
 - jiggy2011 14y ago
 If you're dealing with ascii plaintext the main significant difference is how it deals with new lines vs HTML. The function never purports to do anything other than convert newlines to BR tags.
 - tolmasky 14y ago
 What is being suggested is that the plaintext may contain a random html tag (Perhaps if supplied by a user, or perhaps because that tag is meant to be displayed as plaintext as well. The reason doesn't rally matter, "tags" in any situation are still valid plaintext). By passing text to something that replaces new lines with br the implication is that it is now safe to drop into HTML -- however now that tag from before can take effect (particularly bad if its a script tag). Thus, this function doesn't make sense unless it is at least also coupled with HTML escaping.
 - timdev2 14y ago
 > By passing text to something that replaces new lines with br the implication is that it is now safe to drop into HTML I don't see how that's implied at all. After all, the function is named nl2br, not html2text.
 tolmasky 14y ago
 It's implied because basically the only context under which 's are used is when appearing in HTML. If someone is taking text, converting the newlines to 's, then there's a 99.9% chance that the next step is that that text is going to be placed in a larger HTML document. Unless of course I'm forgetting some alternative use of 's. I agree the function does exactly what it says it will do. And if this was a private function used by something like text2html internally, then maybe it might be a fine function. However, as a public function, the argument is that it inspires bad programming practices, since again, it is almost certainly being used as a primitive form of "sanitation" or "conversion" before displaying plaintext in a larger HTML document. I think if you could come up with an example of how this would be used NOT as an immediate precursor to dropping into HTML I could be convinced otherwise (and saying it is used after the other tags go through a sanitation process is a poor response, since it means this function must always follow the other one -- further proving its uselessness as a standalone function).
- ksherlock 14y ago
 Here's my problem with nl2br: Prior to 4.0.5, it used " ". As of 4.0.5, they switched to " ". (As of 5.3.0, they did the obvious thing and added a second parameter, is_xhtml). This isn't an isolated incident -- any minor update is liable to change how a function works or what parameters it can take. So you're better off writing it yourself (or doing it inline with a string replace or regular expression).
 - josegonzalez 14y ago
 4.0.5 was released in 2001, more than a decade ago. When complaining about a language, complain about a current, feature breakage, not an old one that has since been fixed (5.3.0 came out in 2009, 3 years ago).
 - smsm42 14y ago
 So, where's a problem? That is some godforsaken version that is dead for many years and nobody uses it it was working differently? It's not a problem, it's a feature - the language evolves and changes according to what people need. It happens with all languages and all libraries and all code.
 - eurleif 14y ago
 4.0.5 is a minor version. Minor versions shouldn't change the behavior of existing code (except to fix bugs).
 - smsm42 14y ago
 4.0.5 was more than 11 years ago. 5.0 was released 8.5 years ago. Why, let's discuss something that happened 11 years ago as if it is relevant to anything now.
tszming 14y ago
Not disagreeing what you said, but your quoted example of Python implementation of `nl2br` is wrong, the original PHP's implementation did handle all (\r\n, \n\r, \n and \r), see: http://php.net/manual/en/function.nl2br.php http://php.net/manual/en/function.nl2br.php & http://phpjs.org/functions/nl2br/ http://phpjs.org/functions/nl2br/
- carbocation 14y ago
  Here's what's going on behind the scenes in PHP: https://gist.github.com/4372596 https://gist.github.com/4372596 (Taken from https://github.com/php/php-src/blob/PHP-5.4.9/ext/standard/string.c https://github.com/php/php-src/blob/PHP-5.4.9/ext/standard/s... )
lucian303 14y ago
Actually it can be quite a useful function. In your __unsubstantiated__ opinion it's dumb. EDIT: You want to talk about dumb. An incomplete object model that has no concept of protected members and doesn't enforce encapsulation on "private" ones. This is worse than PHP4 and pales in comparison with PHP5's object model.
- fdr 14y ago
  What's wrong with not enforcing privacy? I have not seen privacy be abused writ large in Python programs, except in cases that are very practical (mostly finicky forms of testing that hit a few critical code paths). I have fairly recently written code in both Python and Ruby, and of the many qualitative differences in how these cultures and languages influence projects written in them, it has never occurred to me that 'real' privacy in Ruby vs. convention-based privacy in Python was the cause of any noticeable difference.
  - smsm42 14y ago
    Nothing wrong with it. Like nothing wrong with having nl2br function. Some don't need private class members. Some don't need nl2br. The wrong is when people think whoever doesn't need exactly what they need is dumb.
    - lucian303 14y ago
      True, but why bake it into the language if it's not enforced? Most OOP requires encapsulation which requires private members and the ability to enforce this privacy. It should not be up to the user to enforce it, as that will never happen.
  - lucian303 14y ago
    What's wrong with it? It's a bug by design that allows a useless feature (access to private members ... why not make everything public then?) and allows the destruction of a key concept of OOP: encapsulation. Which is perfectly fine if you don't need encapsulation.
smsm42 14y ago
Here was I thinking "oh well, topic mentions PHP, how long before people start popping up with obligatory completely irrelevant "PHP sucks" posts?" And here you are. nl2br is a useful function. People use it. If you don't need it, don't use it. How calling it names is helpful to anything? You didn't even bother to explain why "the PHP function was a bad idea to begin with" or why it's a "mess" or why Python people would never need it. But your certainly found time to call it "dumb shit". Here comes the downvote.

carbocation 14y ago

I think that your idea is correct. I would rephrase it to say, "... explain why the PHP function does not belong in the language specification or the standard library to begin with..."

jiggy2011 14y ago

What's wrong with nl2br? Seems to do what it says on the tin.

true_religion 14y ago
Why do trivial functions have to be added to the language core?
- jiggy2011 14y ago
  Why not? Most languages have a standard library that does all kinds of simple but useful stuff. PHP is aimed at the web so a function that deals with part of the web/non-web mismatch seems like a useful thing to include. Removing it would simply cause newbies to have to wrange with str_replace to build trivial web apps.
madjar 14y ago
Except the problem most people actually want to solve is not "convert newlines to ", it is "convert some text to html", and this function may lead to think that it does that, when it only does a tiny fraction of that. And that's how injections are born.
- jiggy2011 14y ago
 If you're dealing with ascii plaintext the main significant difference is how it deals with new lines vs HTML. The function never purports to do anything other than convert newlines to BR tags.
 - tolmasky 14y ago
 What is being suggested is that the plaintext may contain a random html tag (Perhaps if supplied by a user, or perhaps because that tag is meant to be displayed as plaintext as well. The reason doesn't rally matter, "tags" in any situation are still valid plaintext). By passing text to something that replaces new lines with br the implication is that it is now safe to drop into HTML -- however now that tag from before can take effect (particularly bad if its a script tag). Thus, this function doesn't make sense unless it is at least also coupled with HTML escaping.
 - timdev2 14y ago
 > By passing text to something that replaces new lines with br the implication is that it is now safe to drop into HTML I don't see how that's implied at all. After all, the function is named nl2br, not html2text.
 - tolmasky 14y ago
 It's implied because basically the only context under which 's are used is when appearing in HTML. If someone is taking text, converting the newlines to 's, then there's a 99.9% chance that the next step is that that text is going to be placed in a larger HTML document. Unless of course I'm forgetting some alternative use of 's. I agree the function does exactly what it says it will do. And if this was a private function used by something like text2html internally, then maybe it might be a fine function. However, as a public function, the argument is that it inspires bad programming practices, since again, it is almost certainly being used as a primitive form of "sanitation" or "conversion" before displaying plaintext in a larger HTML document. I think if you could come up with an example of how this would be used NOT as an immediate precursor to dropping into HTML I could be convinced otherwise (and saying it is used after the other tags go through a sanitation process is a poor response, since it means this function must always follow the other one -- further proving its uselessness as a standalone function).
ksherlock 14y ago
Here's my problem with nl2br: Prior to 4.0.5, it used " ". As of 4.0.5, they switched to " ". (As of 5.3.0, they did the obvious thing and added a second parameter, is_xhtml). This isn't an isolated incident -- any minor update is liable to change how a function works or what parameters it can take. So you're better off writing it yourself (or doing it inline with a string replace or regular expression).
- josegonzalez 14y ago
 4.0.5 was released in 2001, more than a decade ago. When complaining about a language, complain about a current, feature breakage, not an old one that has since been fixed (5.3.0 came out in 2009, 3 years ago).
- smsm42 14y ago
 So, where's a problem? That is some godforsaken version that is dead for many years and nobody uses it it was working differently? It's not a problem, it's a feature - the language evolves and changes according to what people need. It happens with all languages and all libraries and all code.
 - eurleif 14y ago
 4.0.5 is a minor version. Minor versions shouldn't change the behavior of existing code (except to fix bugs).
 - smsm42 14y ago
 4.0.5 was more than 11 years ago. 5.0 was released 8.5 years ago. Why, let's discuss something that happened 11 years ago as if it is relevant to anything now.

tszming 14y ago

Not disagreeing what you said, but your quoted example of Python implementation of `nl2br` is wrong, the original PHP's implementation did handle all (\r\n, \n\r, \n and \r), see: http://php.net/manual/en/function.nl2br.php http://php.net/manual/en/function.nl2br.php & http://phpjs.org/functions/nl2br/ http://phpjs.org/functions/nl2br/

carbocation 14y ago
Here's what's going on behind the scenes in PHP: https://gist.github.com/4372596 https://gist.github.com/4372596 (Taken from https://github.com/php/php-src/blob/PHP-5.4.9/ext/standard/string.c https://github.com/php/php-src/blob/PHP-5.4.9/ext/standard/s... )

lucian303 14y ago

Actually it can be quite a useful function. In your __unsubstantiated__ opinion it's dumb. EDIT: You want to talk about dumb. An incomplete object model that has no concept of protected members and doesn't enforce encapsulation on "private" ones. This is worse than PHP4 and pales in comparison with PHP5's object model.

fdr 14y ago
What's wrong with not enforcing privacy? I have not seen privacy be abused writ large in Python programs, except in cases that are very practical (mostly finicky forms of testing that hit a few critical code paths). I have fairly recently written code in both Python and Ruby, and of the many qualitative differences in how these cultures and languages influence projects written in them, it has never occurred to me that 'real' privacy in Ruby vs. convention-based privacy in Python was the cause of any noticeable difference.
- smsm42 14y ago
  Nothing wrong with it. Like nothing wrong with having nl2br function. Some don't need private class members. Some don't need nl2br. The wrong is when people think whoever doesn't need exactly what they need is dumb.
  - lucian303 14y ago
    True, but why bake it into the language if it's not enforced? Most OOP requires encapsulation which requires private members and the ability to enforce this privacy. It should not be up to the user to enforce it, as that will never happen.
- lucian303 14y ago
  What's wrong with it? It's a bug by design that allows a useless feature (access to private members ... why not make everything public then?) and allows the destruction of a key concept of OOP: encapsulation. Which is perfectly fine if you don't need encapsulation.

smsm42 14y ago

Here was I thinking "oh well, topic mentions PHP, how long before people start popping up with obligatory completely irrelevant "PHP sucks" posts?" And here you are. nl2br is a useful function. People use it. If you don't need it, don't use it. How calling it names is helpful to anything? You didn't even bother to explain why "the PHP function was a bad idea to begin with" or why it's a "mess" or why Python people would never need it. But your certainly found time to call it "dumb shit". Here comes the downvote.