Attention ASP Coders

[Jeremy W.]

"Java Enabled"... Exactly, just like .NET apps can be deployed on any .NET Enabled platform.

[Goof]

That Mono Project that Jofa quoted looks pretty cool...

Goof

[jofa]

Originally posted by Jeremy W.
PHP.NET has nothing to do with a Unix server.

I know
That's why I wrote "PHP.NET would be for a .NET server what ChiliSoft / Sun ONE ASP is for a unix server"
Meaning: PHP.NET would be something you add to a .NET server, comparable to adding classic ASP support to your unix server using ChiliSoft

[Jeremy W.]

But it isn't the same at all. PHP.NET has nothing to do with anything. If you install .NET on an xNix server (after there is an xNix version) the ONLY thing PHP.NET will add is PHP functionality.

A better comparison is: It's like adding PHP to Apache.

Also, as a warning: please refrain from swearing on SitePoint.

[jofa]

I cannot see the difference between my statement
"to add PHP support for a .NET server you would add PHP.NET"
and Jeremys
"the ONLY thing PHP.NET will add is PHP functionality"



Further, in my opinion, PHP is not a programming language, it's a server application extension
=> adding PHP.NET to ASP.NET is impossible, adding PHP.NET (parallel to ASP.NET) to a .NET server is possible

[Jeremy W.]

Well, I couldn't find your above statement in this thread. You were saying PHP.NET would be like adding ASP to xNix using Chilisoft.

I still have contention with this remark. Support for PHP .NET is built into every .NET enabled server, irregardless of platform. .NET is platform independent. So the talk of OS's, etc is really entirely useless.

Sure, there is no .NET environment for xNix yet however that is just a matter of time. The applications I write NOW in .NET will work on xNix the second the environment is released.

So, the only reason you would add PHP.NET would be to include PHP syntax (not even functionality). You don't gain anything unless PHP is the only language you know (and yes it is a language. I dont' know any server extenion which has it's own language syntax).

[jofa]

Yes, I wrote unix ... should have been apache

PHP is a language?
I thought it was a server application extension that processed scripts written in only one possible scripting language with a certain syntax, this language having the same name as the server application extension to make it more confusing

Jeremy: When you say PHP.NET, do you mean aspx pages with code behind written in a language with the same syntax as PHP?

[Jeremy W.]

Actually, I was under the impression that it contained all of the necessary elements to be considered a language. Definitely not a fully fledged app-writing language, however definitely a scripting language.

The fact that it IS a server extension is besides the point. JVM is also just "an extension".

When I say PHP, I assume the actual webpages would be something like .phpx or something so that web servers could distinguish them from traditional PHP (which wouldn't work under PHP.NET).

[M. Johansson]

I'm confident that .NET will reach a high level of platform indepence in the future. Especially, since C# and the Shared source CLI is now ECMA-standardized AND microsoft has released the source code for both the Windows and FreeBSD CLI - codenamed "Rotor". This makes me confident that .NET will indeed be platform independent, especially considering this:

The current targets are Windows and FreeBSD, but ports to other platforms are possible. Rotor relies on a Platform Adaptation Layer (PAL), which is similar to Apache's Portable Runtime (APR) in that it provides an abstraction layer between the runtime and the operating system. In theory, porting Rotor should involve nothing more than porting the PAL.

We (Microsoft) intend for it to be a fully functional, illustrative, implementation that can be used as a basis for non-commercial experimentation, as courseware, or as a guide for the use of parties working on their own commercial ECMA implementations.

Microsofts own implementation of the standardized CLI is called .. you guessed it... the .NET framework.

[jofa]

The Microsoft .NET Framework and its accompanying C# compiler are a commercial product, and have features not found in the ECMA working drafts
FAQ for the Microsoft Shared Source Implementation of C# and CLI Specifications

[M. Johansson]

Originally posted by jofa
The Microsoft .NET Framework and its accompanying C# compiler are a commercial product, and have features not found in the ECMA working drafts

Of course, the .NET Framework is a production-level implementation, and of course it has extra features - but it still follows the set ECMA standard.

The Shared Source CLI that MS has released is not meant for production purposes, but a good base for developers to look at and implement their own solutions.

[Jeremy W.]

Just as the Mono project will likely have custom options, extensions and features.

[jofa]

Back to the original topic:
Comparision PHP/ASP
Does anyone have some more exact figures than HarryF's "at least as fast as IIS" and "doesn't look like Swiss cheese for security"? (What's wrong with swiss cheese, Harry? )

Here's my subjective judgements:
PHP & Apache are free, and works on a variety of platforms = good
ASP requires (in practise) IIS which is not free = bad
PHP is more compact than ASP (e.g. readfile vs using Scripting.FileSystemObject)
In both PHP & ASP you mix script & html = bad
PHP has no options regarding langauge, in ASP you can choose between VBScript & JScript = bad
In ASP.NET the code is separated from the html and you can (in theory) choose whatever programming language you prefer
If you use Ms Sql Server, then the optimised SqlClient class is excellent for db connections
Summary:
ASP.NET = Brazil
PHP = Germany
ASP = Turkey

[HarryF]

Here's the figures on Apache v2 performance: http://www.eweek.com/article2/0,3959,1873,00.asp

As to security, don't know where to get figures but lets use examples instead. IIS Security Holes vs Apache Hole (that's the first in ages and the response time from finding the hole to news being released on how to fix was under 24 hours). Anyone with a web server can just look in their logs to know how prevailant the IIS holes are - you'll see endless attempted exploits from automatic scripts (my servers's Linux so I smile and relax).

Whether IIS is actually more insecure than Apache I don't know, but it's picked up the reputation and it's stuck. Also I think everyone would agree that the Open Source movement generally handles bug fixes and security patches better than corporations. Anyone who's had to make something secure will know the "security by obscurity" approach (i.e. rather than being truly secure you hide your holes) always ends up biting you in the a$$.

In both PHP & ASP you mix script & html = bad

Wouldn't say that's necessarily bad. Means it's easy to knock up quick pages. PHP has loads of supporting projects to template out HMTL from logic e.g. Smarty and I'm sure ASP has too, so if you know why it's important you do it. Think that's a fair trade off.

PHP has no options regarding langauge, in ASP you can choose between VBScript & JScript = bad

There is one thing you won't see often but is possible Java in PHP scripts. Agree though the VBscript vs. JScript choice probably rattles many ASP newbies.

[M. Johansson]

Originally posted by HarryF
Here's the figures on Apache v2 performance: http://www.eweek.com/article2/0,3959,1873,00.asp

Those figures actually say that apache is head to head with IIS, even on Linux! I found this surprising - I always thought Apache was faster.

Whether IIS is actually more insecure than Apache I don't know, but it's picked up the reputation and it's stuck. Also I think everyone would agree that the Open Source movement generally handles bug fixes and security patches better than corporations. Anyone who's had to make something secure will know the "security by obscurity" approach (i.e. rather than being truly secure you hide your holes) always ends up biting you in the a$$.

Well, I don't have any figures on IIS and Apache security holes, but SecurityFocus has some interesting stats on number of exposed vulnerabilities in operating systems. These figures actually show that Windows does not have more security holes than Linux.

In a way you are right about saying that corporations are generally not as good at handling patches as the open source movement. However, Microsoft has gone very good at handling patches! The little autoupdater built into windows kicks sliced breads butt - it downloaded a vital security fix for me - asked me to install it - I clicked yes. Not until the next day I hear about the exploit (which I'm now protected from) on these very forums.

Wouldn't say that's necessarily bad. Means it's easy to knock up quick pages. PHP has loads of supporting projects to template out HMTL from logic e.g. Smarty and I'm sure ASP has too, so if you know why it's important you do it. Think that's a fair trade off.

I'm glad this issue was brought up, since this is exactely what will separate ASP.NET users and PHP users in the future. In the interview with Rasmus Lerdorf, PHP's creator, he pretty much hits the nail on the head:

In the end, what I think set PHP apart in the early days, and still does today, is that it always tries to find the shortest path to solving the Web problem. It does not try to be a general-purpose scripting language and anybody who's looking to solve a Web problem will usually find a very direct solution through PHP. Many of the alternatives that claim to solve the Web problem are just too complex. When you need something up and working by Friday so you don't have to spend all weekend leafing through 800-page manuals, PHP starts to look pretty good.

This is EXACTLY why PHP is so popular. It's very, very good at quick-n-dirty solutions, not complicated, advanced ones. You don't have to know much programming at all to use it, either.

ASP.NET, on the other hand, is not meant to take the shortest path to solving the problem - it's built for making a reusable, extendable, easily managed, robust solution. Not a fast, simple one.

[HarryF]

Those figures actually say that apache is head to head with IIS, even on Linux! I found this surprising - I always thought Apache was faster.

Errr - IIS doesn't run natively under Linux. Actually they're saying on Windows, Apache 2 is as fast as IIS. Meanwhile on Linux, Apache 2 hasn't improved performance over Apache 1.3 - on Linux the gain in upgrading to 2.0 is more features.

Well, I don't have any figures on IIS and Apache security holes, but SecurityFocus has some interesting stats on number of exposed vulnerabilities in operating systems. These figures actually show that Windows does not have more security holes than Linux.

That may be so, but here we're comparing IIS to Apache and from just keeping an eye on the IT press for the two years, I can remember no more than one Apache vunerability while with IIS I've lost count.

The little autoupdater built into windows kicks sliced breads butt - it downloaded a vital security fix for me - asked me to install it - I clicked yes.

Their autoupdate is nice. But the question is, on your machine, how many OS vunerabilities are that you don't know about that Microsoft does? And who else knows about them. MS uses the security by obscurity approach and from time to time, get caught out when the news gets released before they had time to fix the problem. If they made they code open source, they developer pool would be larger and they'd get feedback from user/developers and basically subject their code to alot more scrutiny. Right now though, they're still releasing Windows versions that aren't fully tested then release patches once the problems are found.

And back to the security focus stats - for me they're too simplistic;

There is a distinct difference in the way that vulnerabilities are counted for Microsoft Windows and other operating systems. For instance, applications for Linux and BSD are often grouped in as subcomponents with the operating systems that they are shipped with. For Windows, applications and subcomponents such as Explorer often have their own packages that are considered vulnerable or not vulnerable outside of Windows and therefore may not be included in the count. This may skew numbers.

For those aware of how Linux distributions and their "subcomponents" get released, you usually have a stable release with no holes, then a whole load of newer releases which are still in development and usually full of holes, with "use at your own risk" attached. In general, Linux users are able to be alot more informed about how secure their system is.

This is EXACTLY why PHP is so popular. It's very, very good at quick-n-dirty solutions, not complicated, advanced ones. You don't have to know much programming at all to use it, either.

I agree with the first part but disagree with the second. I think PHP is also very, very good at the advanced complicated ones. I hear it get knocked for is OO support but personally only hear that coming from those who don't code in PHP. But the only way I can demonstrate how much you can do with PHP is by pointing you at what's in my opinion the most advanced PHP app out there: ezPublish. At first glance it might be compared to a Portal system like PHP Nuke (which it's far better than anyway) but below the skin, it's really an application framework which would allow you to build whatever web app you like is quick time. They're even on their way to releasing an SDK for ezPublish. You even have a Windows based Desktop Edition which allows you to work locally then update ezPublish via an XML-RPC interface. There's good reason why Siemens have gone into partnership with ezSystems.

If you want to see it in action, the admin interface is here (adminublish) and the demo front end is here.

PHP in my opinion is perfectly scalable, from simple to highly advanced - all depends who's at the keyboard.

[M. Johansson]

Originally posted by HarryF
PHP in my opinion is perfectly scalable, from simple to highly advanced - all depends who's at the keyboard.

Of course. But since ASP.NET is strongly typed with a forced OO approach, and PHP is loosely typed, coordination is easier with ASP if you are working on a large project with 20-30 programmers.

I never said PHP couldn't be used for doing large applications, I just said PHP is built for doing it quick, while ASP.NET is built for doing it "properly", which might not always be neccesary, and in those cases mjust a waste of time, especially for joe schomes web site.

PHP CAN, if the coder is good enough, be used to make pretty code very extensive projects, like eZ Publish and vBulletin, but the language is not intended for that - it's intended for solving a problem and solving it in the easiest manner possible.

For instance, take my own learning process.

The story of me and PHP
I begun coding with PHP. Basically, the code I wrote in the beginning was pure crap. Really. I was awful! But it worked. It did the job it was supposed to do. Since it was so poorly coded, it would have been hell to extend or scale the application, but I didn't need to extend or scale it. The darn thing just had to work - and it did.

It took me about 1 year before I discovered the benefits of reusability, and started using functions and classes.

The story of me and ASP.NET
.NET on the other hand is not like that. PHP allows you to write inredibly bad code and get away with it, while ASP.NET just says:

"The compiler returned said:
Error message 422: Go drown yourself, you coder wannabe! This code is the worst code I've ever seen. Go back to art school, loser, and never let me see you write another line of code again, you pathetic monkey! No, I don't care that you will be using this code on your grandmothers web site – her site is an enterprise level application now, since you use ASP.NET!"

From the very beginning, you are forced to use OO coding, main classes, namespaces, enumerations, structs that INCREDIBLY BORING stuff, right from the beginning. I'm learning C# right now, and it's not hard at all, I guess - it's just very, very boring and time-consuming compared to PHP, and it takes much more learning before you can actually start coding any reasonably advanced stuff and simultaneously understand what the heck you are doing.

[jofa]

http://www.eweek.com/article2/0,3959,36938,00.asp

How many OS vulnerabilities are that you don't know about that Microsoft does?

Welcome to the X Files...

Anyway, ASP.NET can enable you to write an infinite amount of code that is very inefficient and performs almost no work - if you don't know what you are doing

[DaveMichaels]

Ho, man! Are they still AROUND? That's so cool. I thought that whole idea was discredited years ago.