7 ms·

Learn PHP – Free interactive PHP tutorial

89 points by ronreiter 13y ago

shubhamjain 13y ago
There are plenty of tutorials around the net which teach the basics quite nicely but none in my eye rank high because none teach how to avoid what PHP is infamous for : spaghetti code. Unknowingly, newbies get the idea of making website as slapping together PHP, HTML in one page. I feel there is one critical section which every author misses, Basics of MVC and getting started with a framework. Edit: grammar and spelling
- leokun 13y ago
  > how to avoid what PHP has been infamous for : spaghetti code Spaghetti code is not what PHP is infamous for. Spaghetti code can be written in any language. PHP is infamous for all library functions being in the global scope, lack of sane naming conventions for those things, terrible type conversions, unsafe libraries, starting php with every request, being able to drop raw php right into html templates - what it was initially designed for, and being just a general web programming language not much useful in any other context. It's also got a bad wrap for being the language of choice for people who do not wish to learn any other language or anything about computer science or computers. PHP is what happened when people learned HTML and saw that once they got to forms they needed something else.
  - ronreiter 13y ago
    If PHP would enforce MVC by not being part of an HTML file, it would have been a very nice language (minus the $ signs everywhere)...
    - homersapien 13y ago
      Why should PHP "force" anything? That's one of PHP's strengths: the ability to be everything from a simple dynamic webpage to a full blown app. That's like saying "I wish someone would make a hammer that only strikes nails, because I'm a poor craftsman and keep hitting my thumb." Love it or hate it, PHP will be around long after elitist devs turn their guns on noSQL and server side JS.
      - neovive 13y ago
        I agree. At it's PHP is just a template language. There are many great PHP MVC framworks that have evolved over the years to incorporate many "best practices". The choice should be up to the developer depending on the project.
        jtreminio 13y ago
        I'm assuming you meant "At its core, PHP is just a template language." That's a ridiculous, extremely over-generalized assertion. I don't know of many "template languages" that treat classes as first-class citizens, has an in-depth, thorough unit testing framework, traits, closures, and and and. I'm sure you get my idea? PHP may have been much simpler at its inception - it is not the same beast now.
        Killswitch 13y ago
        ITT: People who haven't used PHP since 4.2 think they know what the language is like and base all their opinions on a language version over 10 years old. I hate when PHP pops up here on HN, 90% of the people flapping their gabs don't or haven't used PHP for many many years, and when they did it was some Indian's crap code so they spend their time talking shit about a language because they had to fix a bug in Hinderbar's PHP spaghetti from 2003.
        anu_gupta 13y ago
        Yeah, always those damn Indians and their crap code. Every other country's PHP developers write amazingly elegant PHP - it's just those damn Indians.
        jon_r 13y ago
        If there's one thing I've learned in my years of software development it's that software is the great equaliser. Everyone is capable of writing crappy spaghetti code.
        leokun 13y ago
    - georgehotelling 13y ago
      While not enforced at the language level, PSR-1 states that "Files SHOULD either declare symbols (classes, functions, constants, etc.) or cause side-effects (e.g. generate output, change .ini settings, etc.) but SHOULD NOT do both." Basically it stipulates that you should keep classes outside of the main page loader to be compliant.
    - easy_rider 13y ago
      That's so funny. When I look at $'s in PHP, it feels so natural. Then when I see someone use $ in variable names in JS, it gets me agitated.
      - ceejayoz 13y ago
        I typically reserve $ in JS variable names for a version of something that's jQuery-ified. i.e. $(this) = $this;
    - captainmuon 13y ago
      Actually the ability to mix PHP and "HTML" is the only reason I still use PHP occasionally. Sometimes, I have a plain-text file, and would like to use variables or simple loops in it. The best way to do this is PHP! For example, say I want to plot a couple of data columns with gnuplot (an open source plotting program) into several images. I can write a PHP script "myplot.plt.php" that generates a gnuplot script (untested): set terminal png enhanced <?php for ($i = 2; $i <= 4; $i++) { $outputfile = "plot$i.png" echo <<EOT set output "$outputfile" plot "data.txt" u 1:$i EOT; } ?> and then invoke it from gnuplot with load "< php myplot.plt.php" This is a stupid example, but it gets really powerful when you dynamically calculate labels, element positions, etc.. PHP may be a crappy language for web development, but it is a really nice macro language, and has really powerful string processing features, making it ideal for this kind of hack.
  - neovive 13y ago
    I think frameworks such as Laravel and Symphony go a long way towards addressing a lot of these concerns. Although things such as global functions and naming persist, PHP offers easy deployment for new developers and is available on almost all low-cost web hosts that is a major benefit and a must-have for less experienced developers. Depending on your project, if most of your code lives in the front-end, using Laravel/PHP for an API back-end is a nice option these days. It all depends on what you are trying to accomplish and your available knowledge and resources.
  - meritt 13y ago
    > all library functions being in the global scope Ever used C? > lack of sane naming conventions for those things Absolutely annoying but also fairly minimal. Mostly an issue in the string & array functions. > terrible type conversions Weak typing has to coerce somehow. Javascript is equally "terrible" at times. > unsafe libraries Such as? All the major libraries are thread-safe that I'm aware of > starting php with every request PHP exists outside of the web, and even in the web environment, you can run it as fastcgi since inception as a persistent daemon and php-fpm is the standard daemon now as well. > being able to drop raw php right into html templates I view that as a feature (which is often abused by beginners)
    - mavroprovato 13y ago
      > > all library functions being in the global scope > Ever used C? Come on, this is not a good argument. C is a 70's language, we can do better than that, even in 1995 when PHP came out.
    - leokun 13y ago
      By unsafe I meant insecure. Also with C you have to import headers.
    - riquito 13y ago
      > Weak typing has to coerce somehow. Javascript is equally "terrible" at times. >>> "0" == false true !!!!!!! >>> "" == false true >>> "" == "0" false and here we lost the transitive relation...
      - rmrfrmrf 13y ago
        Good. We didn't want it anyway!
  - splawn 13y ago
    > It's also got a bad wrap for being the language of choice for people who do not wish to learn any other language or anything about computer science or computers. That explains why its infamous for spaghetti code.
  - jmspring 13y ago
    A bad programmer in any language will write poor code. I've seen just as many good code bases as bad in pho.
  - username42 13y ago
    One cause of the spaghetti code was the mixing of business logic and of presentation. The separation of concern was easier in smarter languages (like ruby or scala) than in php. Nowadays, templating and presentation is mostly performed on the client side and the server handles only the business. As a result, there is less difference between ruby and php. Nevertheless, the event style of javascript (scala ?) provides better performances.
- ma2rten 13y ago
  Simple. Use a MVC framework.
fein 13y ago
I like it! I frequent the PHP channel on Freenode often, and one thing that would probably be wise is linking http://www.phptherightway.com/ http://www.phptherightway.com/ somewhere in there to try and influence coders to not make bad decisions off the bat. small edit: OOP part should really be using public function __construct(){} over the old style.
- deleted 13y ago
  [deleted]
- leokun 13y ago
  That's kind of like JavaScript the good parts eh? Cool.
  - agumonkey 13y ago
    http://phpthegoodparts.tumblr.com/ http://phpthegoodparts.tumblr.com/ https://twitter.com/TomNomNom/status/195304317601849344 https://twitter.com/TomNomNom/status/195304317601849344 </troll>
- ronreiter 13y ago
  Thanks! Can you send me a pull request with the fixes? I'm not a PHP OOP guru.
  - mgkimsal 13y ago
    pull request sent
ing33k 13y ago
Not bad at all..
awestroke 13y ago
Not trying to bash on PHP or perpetuate the knee-jerk PHP hate, but should we really encourage people to learn PHP? Imagine the effects if the mainstream web development focus would shift from PHP to some more thought-through language(+framework?). The PHP-development community produces some really great things, imagine all that effort expressed through better and more efficient tools!
- parasight 13y ago
  What about people working with legacy code? When I started at my current employer there was a quite a chunk of code written in PHP so learning some PHP wasn't optional.
  - ben0x539 13y ago
    But then those people don't need the encouragement, do they?
- Killswitch 13y ago
  > Not trying to bash on PHP or perpetuate the knee-jerk PHP hate, but should we really encourage people to learn PHP? Too late, you already did. And yes we should. PHP is just as good as Ruby or Python.
  - Conlectus 13y ago
    I would say from a usability / opportunity of employment standpoint they are equal, but PHP seems when working with it far less "designed" than Python and Ruby in my opinion. Things like the inconsistency of single word / snake case / camelcase in method names etc.
  - riquito 13y ago
    Maybe, but the standard library always makes my heart beat faster. We're talking about the language where you have pearls like strcspn, strtr, strstr, strpbrk and at least three different naming styles for the same group of functions (e.g. for strings strtr, str_replace, trim). And good luck with handling non ascii data with the standard library. PHP would need a highly deprecating major version to clean all the rubbish, but it will never happen (see the history of PHP 6.0) disclaimer: I'm a PHP developer (during the day, but at night...)
antirez 13y ago
PHP is probably the language with the best return on investment (of time spent learning) currently. It is extremely easy, and is fast to prototype stuff because of the high level nature. While the language is not as expressive as other languages such as Ruby or Python, it is easy to move on later, but PHP provides everything to get things done and deploy easily your simple application in minimal time. A lot of good programmers today started their web experiences with PHP. Now probably they are using the latest cool thing, but it served as the "BASIC" of our times, and is still active and trying to fix its issues. Also, and this is not a PHP merit, but a disaster with other dynamic languages such as Ruby, the performance you get by default with a simple PHP application, is good enough that is almost always the DB to blame, not the front-end, when there are issues under load.
- shubhamjain 13y ago
  I have been a PHP programmer since long and while I do wish to go up for Django or RoR but I usually get put off by the amount of time I need to spend getting around both. On the other hand, it is so easy to get started with any PHP framework (except Zend, of course) and thats what I love, easiness to get encouraging productive output but seeing the people's prejudice, I feel that I would have to more or less go up for them. I hate the fact how difficult is to associate yourself as "good PHP developer" amongst clueless 3$/hr script kiddies but if you are able to call yourself as a Django developer, you are automatically in the category of a good programmer.
  - antirez 13y ago
    The problem with a low barrier to entry is that there is less filtering, so you get very bad programmers claiming to be experienced developers. However a good programmer can surely use PHP constructs (that are not so much different than the ones offered by other languages at the same level of abstraction) to provide modular and easy to manage code. If the customer wants the cheap developer, she or he will later learn that there is a real difference, and next time will be willing to pay more, as it is actually a way to pay less in the long run...
  - possibilistic 13y ago
MattBearman 13y ago
The hacker in me couldn't resist, entering the following code: echo shell_exec('ls /'); results in: bin dev etc home lib proc spoj tmp usr var I'm sure you've sandboxed it so running rm -rf / wouldn't wipe out your server, but just in case, thought I'd better let you know :)
- possibilistic 13y ago
  Looks like he's okay: echo shell_exec('touch /etc/foo'); touch: cannot touch `/etc/foo': Permission denied
  - csmuk 13y ago
    hmm I hope you set up quotas: shell_exec('cat /dev/zero>byedisk.bin'); and ulimits.... Forky fork fork: shell_exec(':(){ :|:& };:'); PHP step one. Add to ini file: disable_functions=exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source PHP step zero: don't use it to start with (sorry but I've had to clean up so many messes it's unreal)
    - ben0x539 13y ago
      Isn't it more like public-facing app step one: Don't run user-supplied code? This in particular hardly seems to be a php issue. Sandboxing isn't trivial in most languages/environments.
      - csmuk 13y ago
        Yes you're actually entirely right. Therefore I proclaim your point as step -1 ! :) It'd be nice to see solutions like this entirely browser based. LLVM/asm.js?
    - wil421 13y ago
      Following Step 0 would mean no one learns/uses PHP.
jaryd 13y ago
Did anyone else notice that this site is allowing for passthru commands to be executed on the server? The following code: <?php passthru("/bin/uname -a") ?> Results in: Linux checker 2.6.34 #6 SMP Fri Jan 21 15:21:52 CET 2011 i686 GNU/Linux
joshuahornby 13y ago
Can someone please explain to me why PHP gets so much hate? Never quite understood why.
- MrZongle2 13y ago
  Part of it is that PHP has evolved to address some very web-specific needs; in this process, developers of all skill levels have tacked on functionality which tends to give it more of a "thrown together" look which may be horrifying to developers who prefer languages that have been more carefully cultivated. Part of it is a tribal, "Coke vs. Pepsi" kind of thing: the thing I am familiar with is good, what I am not familiar with is threatening and/or bad. Part of it is because there are some downright terrible examples of PHP code out there. One of PHP's implementation strengths is a PR weakness: it is very easy for complete beginners to use it. It's like a zero-entry pool: anybody who wants to get into the pool can get into the pool. Some of those people shouldn't go into the deep end, but do so anyway.... and the byproduct of this can be horrifying and perhaps counterproductive for others. As a PHP developer for 5+ years (with plenty of experience prior with ASP.NET and ColdFusion), I can attest that the language is a bit homely and doesn't posess a lot of cool features supported by other languages. But it works, it works well at what it was designed for, and continues to evolve (albeit slowly sometimes). It's an adjustable wrench set that sometimes gets criticized because it doesn't include screwdrivers or hammers.
  - tmikaeld 13y ago
    Very well formulated. I might want to add that since PHP is so available (it really is) - it's easy to throw functionality together get it "working" and try selling it - the buyers of course getting disappointed and thus hating PHP. And that hiring a PHP developer with "experience" doesn't really mean much, so a hiring person/firm that is not entirely specific with requirements will get really angry and disappointed with the results. This can be avoided quite easily by not being a cheap SOB (There's no such thing as 800$/month Sr dedicated developer), choosing a developer with proper references and actually planning the project before starting to work on it.
- ronreiter 13y ago

89 points by ronreiter 13y ago

There are plenty of tutorials around the net which teach the basics quite nicely but none in my eye rank high because none teach how to avoid what PHP is infamous for : spaghetti code. Unknowingly, newbies get the idea of making website as slapping together PHP, HTML in one page. I feel there is one critical section which every author misses, Basics of MVC and getting started with a framework. Edit: grammar and spelling

leokun 13y ago
> how to avoid what PHP has been infamous for : spaghetti code Spaghetti code is not what PHP is infamous for. Spaghetti code can be written in any language. PHP is infamous for all library functions being in the global scope, lack of sane naming conventions for those things, terrible type conversions, unsafe libraries, starting php with every request, being able to drop raw php right into html templates - what it was initially designed for, and being just a general web programming language not much useful in any other context. It's also got a bad wrap for being the language of choice for people who do not wish to learn any other language or anything about computer science or computers. PHP is what happened when people learned HTML and saw that once they got to forms they needed something else.
- ronreiter 13y ago
  If PHP would enforce MVC by not being part of an HTML file, it would have been a very nice language (minus the $ signs everywhere)...
  - homersapien 13y ago
    Why should PHP "force" anything? That's one of PHP's strengths: the ability to be everything from a simple dynamic webpage to a full blown app. That's like saying "I wish someone would make a hammer that only strikes nails, because I'm a poor craftsman and keep hitting my thumb." Love it or hate it, PHP will be around long after elitist devs turn their guns on noSQL and server side JS.
    - neovive 13y ago
      I agree. At it's PHP is just a template language. There are many great PHP MVC framworks that have evolved over the years to incorporate many "best practices". The choice should be up to the developer depending on the project.
      - jtreminio 13y ago
        I'm assuming you meant "At its core, PHP is just a template language." That's a ridiculous, extremely over-generalized assertion. I don't know of many "template languages" that treat classes as first-class citizens, has an in-depth, thorough unit testing framework, traits, closures, and and and. I'm sure you get my idea? PHP may have been much simpler at its inception - it is not the same beast now.
        Killswitch 13y ago
        ITT: People who haven't used PHP since 4.2 think they know what the language is like and base all their opinions on a language version over 10 years old. I hate when PHP pops up here on HN, 90% of the people flapping their gabs don't or haven't used PHP for many many years, and when they did it was some Indian's crap code so they spend their time talking shit about a language because they had to fix a bug in Hinderbar's PHP spaghetti from 2003.
        anu_gupta 13y ago
        Yeah, always those damn Indians and their crap code. Every other country's PHP developers write amazingly elegant PHP - it's just those damn Indians.
        jon_r 13y ago
        If there's one thing I've learned in my years of software development it's that software is the great equaliser. Everyone is capable of writing crappy spaghetti code.
        leokun 13y ago
  - georgehotelling 13y ago
    While not enforced at the language level, PSR-1 states that "Files SHOULD either declare symbols (classes, functions, constants, etc.) or cause side-effects (e.g. generate output, change .ini settings, etc.) but SHOULD NOT do both." Basically it stipulates that you should keep classes outside of the main page loader to be compliant.
  - easy_rider 13y ago
    That's so funny. When I look at $'s in PHP, it feels so natural. Then when I see someone use $ in variable names in JS, it gets me agitated.
    - ceejayoz 13y ago
      I typically reserve $ in JS variable names for a version of something that's jQuery-ified. i.e. $(this) = $this;
  - captainmuon 13y ago
    Actually the ability to mix PHP and "HTML" is the only reason I still use PHP occasionally. Sometimes, I have a plain-text file, and would like to use variables or simple loops in it. The best way to do this is PHP! For example, say I want to plot a couple of data columns with gnuplot (an open source plotting program) into several images. I can write a PHP script "myplot.plt.php" that generates a gnuplot script (untested): set terminal png enhanced <?php for ($i = 2; $i <= 4; $i++) { $outputfile = "plot$i.png" echo <<EOT set output "$outputfile" plot "data.txt" u 1:$i EOT; } ?> and then invoke it from gnuplot with load "< php myplot.plt.php" This is a stupid example, but it gets really powerful when you dynamically calculate labels, element positions, etc.. PHP may be a crappy language for web development, but it is a really nice macro language, and has really powerful string processing features, making it ideal for this kind of hack.
- neovive 13y ago
  I think frameworks such as Laravel and Symphony go a long way towards addressing a lot of these concerns. Although things such as global functions and naming persist, PHP offers easy deployment for new developers and is available on almost all low-cost web hosts that is a major benefit and a must-have for less experienced developers. Depending on your project, if most of your code lives in the front-end, using Laravel/PHP for an API back-end is a nice option these days. It all depends on what you are trying to accomplish and your available knowledge and resources.
- meritt 13y ago
  > all library functions being in the global scope Ever used C? > lack of sane naming conventions for those things Absolutely annoying but also fairly minimal. Mostly an issue in the string & array functions. > terrible type conversions Weak typing has to coerce somehow. Javascript is equally "terrible" at times. > unsafe libraries Such as? All the major libraries are thread-safe that I'm aware of > starting php with every request PHP exists outside of the web, and even in the web environment, you can run it as fastcgi since inception as a persistent daemon and php-fpm is the standard daemon now as well. > being able to drop raw php right into html templates I view that as a feature (which is often abused by beginners)
  - mavroprovato 13y ago
    > > all library functions being in the global scope > Ever used C? Come on, this is not a good argument. C is a 70's language, we can do better than that, even in 1995 when PHP came out.
  - leokun 13y ago
    By unsafe I meant insecure. Also with C you have to import headers.
  - riquito 13y ago
    > Weak typing has to coerce somehow. Javascript is equally "terrible" at times. >>> "0" == false true !!!!!!! >>> "" == false true >>> "" == "0" false and here we lost the transitive relation...
    - rmrfrmrf 13y ago
      Good. We didn't want it anyway!
- splawn 13y ago
  > It's also got a bad wrap for being the language of choice for people who do not wish to learn any other language or anything about computer science or computers. That explains why its infamous for spaghetti code.
- jmspring 13y ago
  A bad programmer in any language will write poor code. I've seen just as many good code bases as bad in pho.
- username42 13y ago
  One cause of the spaghetti code was the mixing of business logic and of presentation. The separation of concern was easier in smarter languages (like ruby or scala) than in php. Nowadays, templating and presentation is mostly performed on the client side and the server handles only the business. As a result, there is less difference between ruby and php. Nevertheless, the event style of javascript (scala ?) provides better performances.
ma2rten 13y ago
Simple. Use a MVC framework.

fein 13y ago

I like it! I frequent the PHP channel on Freenode often, and one thing that would probably be wise is linking http://www.phptherightway.com/ http://www.phptherightway.com/ somewhere in there to try and influence coders to not make bad decisions off the bat. small edit: OOP part should really be using public function __construct(){} over the old style.

deleted 13y ago
[deleted]
leokun 13y ago
That's kind of like JavaScript the good parts eh? Cool.
- agumonkey 13y ago
  http://phpthegoodparts.tumblr.com/ http://phpthegoodparts.tumblr.com/ https://twitter.com/TomNomNom/status/195304317601849344 https://twitter.com/TomNomNom/status/195304317601849344 </troll>
ronreiter 13y ago
Thanks! Can you send me a pull request with the fixes? I'm not a PHP OOP guru.
- mgkimsal 13y ago
  pull request sent

ing33k 13y ago

Not bad at all..

awestroke 13y ago

Not trying to bash on PHP or perpetuate the knee-jerk PHP hate, but should we really encourage people to learn PHP? Imagine the effects if the mainstream web development focus would shift from PHP to some more thought-through language(+framework?). The PHP-development community produces some really great things, imagine all that effort expressed through better and more efficient tools!

parasight 13y ago
What about people working with legacy code? When I started at my current employer there was a quite a chunk of code written in PHP so learning some PHP wasn't optional.
- ben0x539 13y ago
  But then those people don't need the encouragement, do they?
Killswitch 13y ago
> Not trying to bash on PHP or perpetuate the knee-jerk PHP hate, but should we really encourage people to learn PHP? Too late, you already did. And yes we should. PHP is just as good as Ruby or Python.
- Conlectus 13y ago
  I would say from a usability / opportunity of employment standpoint they are equal, but PHP seems when working with it far less "designed" than Python and Ruby in my opinion. Things like the inconsistency of single word / snake case / camelcase in method names etc.
- riquito 13y ago
  Maybe, but the standard library always makes my heart beat faster. We're talking about the language where you have pearls like strcspn, strtr, strstr, strpbrk and at least three different naming styles for the same group of functions (e.g. for strings strtr, str_replace, trim). And good luck with handling non ascii data with the standard library. PHP would need a highly deprecating major version to clean all the rubbish, but it will never happen (see the history of PHP 6.0) disclaimer: I'm a PHP developer (during the day, but at night...)

antirez 13y ago

PHP is probably the language with the best return on investment (of time spent learning) currently. It is extremely easy, and is fast to prototype stuff because of the high level nature. While the language is not as expressive as other languages such as Ruby or Python, it is easy to move on later, but PHP provides everything to get things done and deploy easily your simple application in minimal time. A lot of good programmers today started their web experiences with PHP. Now probably they are using the latest cool thing, but it served as the "BASIC" of our times, and is still active and trying to fix its issues. Also, and this is not a PHP merit, but a disaster with other dynamic languages such as Ruby, the performance you get by default with a simple PHP application, is good enough that is almost always the DB to blame, not the front-end, when there are issues under load.

shubhamjain 13y ago
I have been a PHP programmer since long and while I do wish to go up for Django or RoR but I usually get put off by the amount of time I need to spend getting around both. On the other hand, it is so easy to get started with any PHP framework (except Zend, of course) and thats what I love, easiness to get encouraging productive output but seeing the people's prejudice, I feel that I would have to more or less go up for them. I hate the fact how difficult is to associate yourself as "good PHP developer" amongst clueless 3$/hr script kiddies but if you are able to call yourself as a Django developer, you are automatically in the category of a good programmer.
- antirez 13y ago
  The problem with a low barrier to entry is that there is less filtering, so you get very bad programmers claiming to be experienced developers. However a good programmer can surely use PHP constructs (that are not so much different than the ones offered by other languages at the same level of abstraction) to provide modular and easy to manage code. If the customer wants the cheap developer, she or he will later learn that there is a real difference, and next time will be willing to pay more, as it is actually a way to pay less in the long run...
- possibilistic 13y ago

MattBearman 13y ago

The hacker in me couldn't resist, entering the following code: echo shell_exec('ls /'); results in: bin dev etc home lib proc spoj tmp usr var I'm sure you've sandboxed it so running rm -rf / wouldn't wipe out your server, but just in case, thought I'd better let you know :)

possibilistic 13y ago
Looks like he's okay: echo shell_exec('touch /etc/foo'); touch: cannot touch `/etc/foo': Permission denied
- csmuk 13y ago
  hmm I hope you set up quotas: shell_exec('cat /dev/zero>byedisk.bin'); and ulimits.... Forky fork fork: shell_exec(':(){ :|:& };:'); PHP step one. Add to ini file: disable_functions=exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source PHP step zero: don't use it to start with (sorry but I've had to clean up so many messes it's unreal)
  - ben0x539 13y ago
    Isn't it more like public-facing app step one: Don't run user-supplied code? This in particular hardly seems to be a php issue. Sandboxing isn't trivial in most languages/environments.
    - csmuk 13y ago
      Yes you're actually entirely right. Therefore I proclaim your point as step -1 ! :) It'd be nice to see solutions like this entirely browser based. LLVM/asm.js?
  - wil421 13y ago
    Following Step 0 would mean no one learns/uses PHP.

jaryd 13y ago

Did anyone else notice that this site is allowing for passthru commands to be executed on the server? The following code: <?php passthru("/bin/uname -a") ?> Results in: Linux checker 2.6.34 #6 SMP Fri Jan 21 15:21:52 CET 2011 i686 GNU/Linux

joshuahornby 13y ago

Can someone please explain to me why PHP gets so much hate? Never quite understood why.

MrZongle2 13y ago
Part of it is that PHP has evolved to address some very web-specific needs; in this process, developers of all skill levels have tacked on functionality which tends to give it more of a "thrown together" look which may be horrifying to developers who prefer languages that have been more carefully cultivated. Part of it is a tribal, "Coke vs. Pepsi" kind of thing: the thing I am familiar with is good, what I am not familiar with is threatening and/or bad. Part of it is because there are some downright terrible examples of PHP code out there. One of PHP's implementation strengths is a PR weakness: it is very easy for complete beginners to use it. It's like a zero-entry pool: anybody who wants to get into the pool can get into the pool. Some of those people shouldn't go into the deep end, but do so anyway.... and the byproduct of this can be horrifying and perhaps counterproductive for others. As a PHP developer for 5+ years (with plenty of experience prior with ASP.NET and ColdFusion), I can attest that the language is a bit homely and doesn't posess a lot of cool features supported by other languages. But it works, it works well at what it was designed for, and continues to evolve (albeit slowly sometimes). It's an adjustable wrench set that sometimes gets criticized because it doesn't include screwdrivers or hammers.
- tmikaeld 13y ago
  Very well formulated. I might want to add that since PHP is so available (it really is) - it's easy to throw functionality together get it "working" and try selling it - the buyers of course getting disappointed and thus hating PHP. And that hiring a PHP developer with "experience" doesn't really mean much, so a hiring person/firm that is not entirely specific with requirements will get really angry and disappointed with the results. This can be avoided quite easily by not being a cheap SOB (There's no such thing as 800$/month Sr dedicated developer), choosing a developer with proper references and actually planning the project before starting to work on it.
ronreiter 13y ago