Given how much has been deprecated/removed since 5.2, would you care to list some that remain?
$foo = 1; $foo[1]; // no problems
$foo = true; $foo[0]; // seems good to php
PHP's choose-your-own-error-adventure with all errors on (which is the only good choice) is pretty silly. arrays become somewhat unwieldy because the core libs for arrays are deficient, missing things like a get_default($array, $key, $default).
The array core lib in general is troublesome to understand/intuit different pieces for, probably because mashing hash types and lists together leads to all sorts of ambiguity (like ambiguous json decoding/encoding). Want some subset of an array? Sure, that's the super-intuitive `array_intersect_key($array, array_flip($keys));`
The core array type is really a frustrating experience in PHP, and interop deficiencies with ArrayObject make it unusable as an alternative.
$array[$key] ?? $default
im still not sure what any of this has to do with "the only secure php is no php"?
isset($array[$key]) ? $array[$key] : $default
Which is, admittedly, just a bit uglier.
Edit: isset() is a language construct, not a function call. So it does not incur performance penalties. The ?? operator was introduced for 'cosmetic' reasons only, so don't rush to update your source...
I wouldn't take that criticism too personally. People also argue that C/C++ can't ever be secure due to the ease of programmer mistakes.
Use === instead; except for cryptography, where you want hash_equals().
> There's a lot of discipline/linting still required in PHP, whereas other languages won't even compile if you do something risky.
And/or just use scalar type declarations: https://3v4l.org/SJKe1
I've actually gone as far as rejecting commits that failed the linter and style checker, but that only works for code bases I have control over. It doesn't apply to the libs.
I now prefer languages where the entire ecosystem is passing strict compilation requirements.
That's not truthiness, that's implicit coercions.
Truthiness is specific to boolean contexts (if, while, explicit conversion to boolean).
What I really meant was that you have some $variable, and you test it in an if, while, etc. context. If the value is 0, it's false. But if you didn't realize you got a string from somewhere, it might be true. Unless it's an empty string? (I can't even remember.)
None of this changes the initial point, which is that writing "good" PHP requires enormous amounts of discipline, and that still doesn't address the security issues with PHP itself. I remember when the developer of Suhosin basically quit PHP and said he couldn't deal with the way its maintainers treated security issues.
Something like:
The only secure PHP is version x.x or newer.> Given how much has been deprecated/removed since 5.2, would you care to list some that remain?
For the version coming out at the end of the year, what is still insecure that leads you to believe "there is not an $x where that a statement is true"?
7.x is better than 5.x but not GOOD ENOUGH.
What would make it good enough? Be specific.