Comment by menelaus35 | Hacker News Reader

Comment by menelaus35 | Hacker News Reader

Write an API for my client app which returns user's data as JSON (or render HTML page for profile);

You:

{

<?php

mysql_connect("host", "pass"); mysql_select_db("users");

$uid = $_GET[ "uid" ];

$res = mysql_query( "select * from users where uid = $uid" );

$ar = mysql_fetch_assoc( $res );

echo "name: " . $ar["name"] . ","; echo "location: " . $ar["location"];

?>

}

Just call it http://domain.com/api.php?uid=USER_ID

( Yeah I know you want to scream and say all the things about this code, but this is kind of code you would encounter with PHP, most of the time it's more horrifying than this one. )

People use it PHP for this reason, If you want to make same functionality in another language you need to setup an app and all the necessary things that protect you from garbage, some obvious security issues and bugs, not a single file like this. It's so easy and so wrong, it should be illegal to do this. Create a file and put it into directory and call it from your browser. You don't have to know anything about web or web servers and stuff. You just make shit by copying and pasting from internet, that's why Facebook made by PHP and now there are whole teams who are trying to protect company from PHP horrors. (They made a PHP VM, bunch of software to analyze PHP and optimize it etc. )

Just don't try to justify PHP, do not defend it. It's shit and you know it, accept it and move on.

(Note: do you remember Facebook's profile.php pages, they are still exists you can call it just like old times profile.php?id=YOUR_ID, yeah it's a shit once you get infected you're not gonna get out of it completely. Even if you can, it leaves traces on you just like profile.php URL's

The way you write code I wouldn't trust you with any language really. You give 6 lines of code and it has display of all the worst practices that I haven't seen since I read a 13year olds tutorial on the language back in 2003.

Hi, can you list all the worst practices you see in this code? Just curious of the full list

No input validation for one, possibility for SQL injection is another.

I'm no expert but since he didn't reply:

- Use of mysql_ functions (This extension was deprecated in PHP 5.5.0, and it was removed in PHP 7.0.0. Instead, the MySQLi or PDO_MySQL extension should be used)

- Using the user input directly in the query instead of binding, using prepared statements, or at the very least casting to an integer (don't do this)

- (besides mixing multiple layers) Possible whitespace problems in the output validation (if you're using JSON), you want most php code to be "validated" (like using json functions), to have proper headers, to output types correctly (like booleans). This is also why you should never use PHP's closing tag, except for things like pure PHP templating, it's even in the PSR-2:

> The closing ?> tag MUST be omitted from files containing only PHP.

Not really the case here but you get the idea. It's like you're using a "html view" to output JSON API stuff.

- Possible "Undefined index", or worse, at $ar["name"], $ar["location"]

- Having to write some ugly conditionals if you have more than a single result and need to end the sequence without a comma or do any kind of transformation

- Trying to save vertical space by using expressions in the same line, sacrificing readability

- No error handling. What if the DB connection fails?

- Output is not valid JSON

http://www.php-fig.org/psr/psr-2/

http://phptherightway.com/

http://jsonlint.com/

> The closing ?> tag MUST be omitted from files containing only PHP.

It doesn't contain only PHP. There's the closing JSON } after ?> :D

I'm fairly certain that, that was exactly the parents' point - this is what you'd often see from a beginner in PHP.

Not sure if intentional or not, but your code has an SQL injection vulnerability.

Relevant and crushingly obvious XKCD: https://xkcd.com/327/

If it was an intentional joke in the grandparent post's code, then it's not one that came across well.

Maybe we are from different universe. Nowadays it's fairly common to use ORM in PHP.

Reply on news.ycombinator.com