4 ms·
> You should be using htmlspecialchars() instead. Without trying to be too much of an arrogant arsehole, surely they should be using a proper language. That is
by hahainternet 13y ago
> You should be using htmlspecialchars() instead.
Without trying to be too much of an arrogant arsehole, surely they should be using a proper language. That is the real core cause of the problem here isn't it?
- fooyc 13y agoNothing specific to the language here. Mentioned functions do exactly what their names imply. Just like ruby or python, PHP has great templating languages, support for prepared statements, etc.
- hahainternet 13y agoThis is often said, but these problems are practically endemic in the PHP 'community'. I can't help but think that the lack of proper documentation or basic explanations is responsible.
- jasonlotito 13y agoI'm glad you put community in quotes. The problem is not endemic in the PHP community.
- nucleardog 13y agoThere really is no 'community'. The official documentation is fine (the included comments actually make it pretty good). The problem is mostly the widespread support and low barrier to entry. PHP is supported on every crappy $2/m hosting plan. It's also the language of a lot of the net's more popular CMSs. (WordPress?). People have a site and want to make it do stuff. The site is already either using PHP or that's all the host supports. PHP gets most of the users who aren't trying to get into programming (and may have no interest in it whatsoever) - they just wanna get something done. Some of those people develop an interest and stick around and learn the language, but aren't really forced to learn any software development methodologies. PHP acts as a filter, collecting all of the non-programmers and people who have stumbled into programming accidentally or unintentionally. People who write Ruby or Python are generally people who set out to be a programmer. The language itself has its warts, but I see the above, not the warts, as the primary driver of all the crappy code out there.
- tudborg 13y agoYou can be an idiot in any language, including PHP. Blaming the tool is exactly what gets you in to this mess in the first place. The fault is with the programmer. No one else.
- hahainternet 13y agoIt's true that you can be an idiot in any language, but I have written production code in every 'high level' language of this type and only PHP seems to suffer from this problem. Take a random mail form, even has its own domain: http://jemsmailform.com/ http://jemsmailform.com/ Finding the obvious problems I leave as an exercise.
- user24 13y agoI kindly direct you to search for "formmail.pl".
- jtreminio 13y agophp isn't going to hold your hand, if you want to write awful code or don't know any better then god help you. That said, all the mysql_* functions have been officially deprecated and we steer newbies to using pdo and named parameters.
- stan_rogers 13y agoI'm trying very hard to think of a language that won't, by default, allow you to throw user-generated HTML onto an HTML page if it allows you to create an HTML page at all that incorporated user-generated (or, in fact, program- or programmer-generated) strings. Angle brackets, etc., are only situationally bad. (And let us separate language from framework here; the languages used in templating frameworks will almost always allow you to emit HTML should you choose to do so.)
- hahainternet 13y agoIt's true a turing complete language has no way of stopping you, but there are ways around this that many frameworks and languages have adopted. Taint mode, for example.