It is also a weakness because so many people don’t learn how to apply security properly and so PHP gets a reputation for having security issues where PHP itself is secure and it is only the code where people introduce deliberate security holes where it isn’t (eg. those newbies who create security holes such as:
$email = $_POST['email];
instead of something like
$email = (filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) ? $_POST['email'] : false;
if (!$email) { /* error processing followed by */ exit;}
// absolutely no other references to $_POST['email'] anywhere after this
I understand your point. Just one thing here though. I wouldn’t say the security holes are deliberately introduced, when we’re talking about beginners. They wouldn’t even know they are doing something wrong. So the holes are there more because the beginners are misinformed and lack the proper education. Wouldn’t you say?
I learned PHP from the first edition of Kevin Yank’s book Build a database driven website with PHP and MySQL (I think that’s the title) and only recently (like a few months ago) realised that I shouldn’t be using the kind of code that would cause @felgall to choke over his coffee!
I meant ‘deliberately introduced’ in that they added the code that makes things worse by bypassing security already built into PHP (even though they may be unaware of it because they just copied other newbie code)…
Using $_POST['email'] throughout their code rather than assigning another name to it would be an example of NOT introducing security but also NOT removing security that is already there.
Indeed. I remember the story of a professor who invented a new language which contained no error checking. When asked how he would handle the situation of a data prep “girl” mis-keying something, he replied “I’d sack her!”
I don’t think it is right to blame a language for what typically just comes down to poor engineering. Poor engineering is just more prevalent in php due to its low level of entry. There many more designers and enthusiast hacking up php code than there are in other languages such as; Java, C, Ruby, Python, and Node. The barrier to create a basic web page is much higher in those languages than in php. We experience the low level of entry every day on this very forum when something as simple as installing xdebug or standing up a vm, using PDO seems to be information overload for many people using php… If I’m going to blame anything it will be xamp not php. Without xamp half the people using the language would be lost. I dislike picking on people but the reason this very forum is so active is because many people who “program” in php don’t know what they are doing. The questions regarding simple syntax issues in php far out-weigh those in other languages.
I whole heartedly agree. The same mistake can easily be made in Ruby, Node, .NET, and so forth. The reason it doesn’t happen is because the toolset, the installation, and the cost of development/hosting is much higher, which blocks out a lot of the “I’m new to programming” and therefore you have more experience programmers picking up and playing with another language who have learned these mistakes already.
I think we should embrace the fact newcomers to web application programming come to PHP first. What needs to be done, and it is happening, are things like PHP: The Right Way. We need more free learning sites like CodeAcademy or Learn PHP and even paid learning sites like Treehouse. And we need more great communities with understanding mentors like Sitepoint.
So, let’s please not brood in grief over the newcomers (if anyone is). Let’s celebrate them. And absolutely! The beginners are definitely NOT a reason for calling PHP bad. They, or rather the low entry threshold, are one of the reasons PHP is so popular, which makes it fun! Fun, because we have constant challenges to conquer. You see, mastering things is part of the human soul. And PHP, even with all its quirks, is fun, maybe because of its quirks. But, certainly too, because it is easy to get a result quickly. The first feeling of achievement can happen fast with PHP. That is most definitely a very good thing!
We really need to shrug off the past. It is the past. It’s history. We learn from it, learn from the mistakes made and do better, hopefully, because of it. We need to be proud of any accomplishments made. And we can most definitely be proud of the PHP community we are a part of. I know I am.
I don’t think anyone is (other than those using the poor quality of code many of those newcomers write as an excuse to say that PHP itself has issues).
I confess I only made it through the first of your links. The question is:
There are 42 answers, most of which suggest learning PHP.
Of the remainder, javascript is the most popular suggestion. Which is a bit confusing because the the poster is already learning javascript. I think some of the people meant nodejs/server side but it is really not clear. I suspect that at least some of the folks who answered don’t actually know what php is or the difference between server side and client side.
Of the 42 answers, I could only classify three as being php hater type answer. To my thinking at least, 3/42 is quite low. The only one of the three that contained any details was a clear copy/paste rant. The other two just asserted that php is evil and left it like that.
In any event, a well written article addressing php7 and recommended practices will certainly not hurt things. Looking forward to reading it.
And just as a final note: One reason that I dislike Quora is that the original question can be modified, often significantly. Many of the answers seem to be addressing a different question.
I only glazed over the subject matter. In the later references, the articles are not older than one year old. (I searched for results within the last year). My goal is to give the community another better more up-to-date article to link to.
PHP is like a toolkit originally designed for making tables and chairs. Small planes, maybe a lathe, a router, some screwdrivers, a wrench, a sander, etc. People liked it so much that they started trying to build sheds with it, then cabins, then houses. The toolkit maintainer kept adding things ad-hoc as they were desired, and now people are using the toolkit to build skyscrapers. Other people come in and say “what the hell do you need a hand-held plane for if you’re building skyscrapers, MORONS!?” We don’t use that bit for skyscrapers, but we might when we build a playhouse for our kids.
I would say reading through Eevee’s article has been an interesting/entertaining process
Personally I agree on many of his points, if we look at the inconsistency of function names he is correct. It is a internal mess that I think we could benefit from updating, even if it means if this means to break backwards compatibility.
On the other side, the rest of his article, well… lets just say it makes it look like PHP somehow got on his wrong side
There is a lot of inconsistencies, even at the time the article was published, where the code examples written is not syntax correct for their intended uses, and by that cause the seemingly “wrong result”.
Other parts, are ramblings on stuff that does not really matter, as you would never do that in any programming languages.
I honestly think you worry too much about his article, its impact on the PHP reputation is a minor one at best. There will always be developers that write how “bad language X is” compared to their language of choice. What differentiate real developers from developers, is that you have grown above this and realize that every language has their use.
On a side note on Ruby, I attended a Rails conference last year as I was in the area, and I was surprised by the issues some of the attendees faced running their code on enterprise systems (high traffic). At that point, I was glad that I work with PHP, as the issues we face when doing enterprise development pale compared to that.
You might be right. However, anyone put off by the article in any way (especially young people wanting to learn web application programming) is a situation, which is generally wrong and shouldn’t happen. The fact Eevee leaves that article for all to see is in fact wrong. I want to simply counter that with a more up-to-date message about PHP’s current situation.
Do you remember what their issues were? Just curious.
A point about the article is that it only lists issues with php language so the reader might think that other languages are so much better because they don’t have such a long list of issues. People have a tendency to think the grass is greener on the other side so it would be nice to see the other side or at least read about the experience of those who have been on the other side.
If you are willing to take on that task and have the time, then the rest of us should at least try to help out as well
I am reluctant to say too much, since I my knowledge on enterprise systems in Rails is not good. So I dont know if the problems some of the participants told me about, is due to how they manage their cluster or even development, or if it is a common issue.
The issue resolved mostly around uptime. Basically serving the website to a large number of visitors without it going down. Some complained on that the web server just stopped working with no warnings or errors and had to be rebooted. Leaving you with a scenario where some of the servers in the cluster worked, and others did not. Anyway as mentioned, I dont know if this is a common problem with Rails or if it was due to improper setup.
