Hacker News Reader

Comment by toast0 | Hacker News Reader

You can get $5 shared webhosting anywhere and use php. Or apt-get the php Apache module and be ready.

The barrier to entry is very very low (for better or worse), and if you're careful and avoid most of the crazy, you can make really fast , low overhead, lightly dynamic pages. Of course, it also gives you more than enough rope to get yourself into a lot of trouble, and I have feelings about the modern trend of obfuscating things with frameworks and autoloads, but lots of people think they're great.

View on HN

Nearly all free webhosts run PHP too.

The barrier to entry is very very low

This, absolutely this. There's literally nothing to configure or setup beyond PHP itself. You open a text editor and write your script, save the file, drop it on the server and it's immediately ready to run. No messing around with convoluted toolchains, massive frameworks, or some elaborate "build process" just to get a "Hello world" to work.

I'm not sure if it's even a majority of users, but PHP certainly appeals to those of us who like writing plain HTML in a text editor and being able to immediately refresh the browser that has it open to see the effects of changes.

The language itself has its warts, but they're easy to avoid and IMHO the disadvantages pale in comparison to the extreme simplicity of getting started and continuing to work.

be ready to what though? make another exploitable website on the internet that will inevitably join a botnet?

Can you show some data? I'm interested to see how exploitable popular PHP frameworks (Laravel and Symfony?) and the language itself are over the years in comparison to JavaScript, Python and Ruby web stuff. Not interested in anecdotes or bad code from bad programmers (aka Wordpress plugins) being used as an argument.

My company has some legacy PHP stuff that is rock solid, making money for years, survived every single audit (and PHP 7 cut our server costs by half).

WordPress is probably the most deployed php framework and it is extremely exploited.

WordPress is heavily hampered by a refusal to break backwards compatibility. https://wordpress.org/about/requirements/

> WordPress also works with PHP 5.2.4+

That's a nearly eight years end-of-lifed version.

Still waiting for source for all those claims. I'm not being ironic or anything but people throw things under the bus so easily it would be nice to see the data (comparison).

Their numbers are huge so of course the number of exploited servers will be higher in raw numbers, but is the core "extremely" exploited or is the plugins the real problem? We should be talking about the language/merits but I'll listen to arguments about the ecosystem. Just feels really dumb to talk about things like plugins. It's like saying JS is crap because 70% of the web extensions written in JS are sold to the botnet or are pure crap. Or how a popular operating system has more CVEs because it's popular. Not sure how to explain better what I want to say so let's just leave at that.

WP plugins are where these exploits are, less so in WP core

Having the possibility of using a cheap hosting service like hostgator (for instance) is one of the biggest advantages of using something mainstream like php.

It's not about control it's about ease of use. You can get a cheap shared hosting account and upload your php site in minutes without configuring a thing. Not everyone wants or needs to manage a server.

Think about a small business with no tech experience that just needs a basic marketing site. They download some cheap Wordpress theme, make it say what they want and upload it. Easy! Digital Ocean would be a disaster for them.

This is 100% true, and furthermore, the process you just described is still too complicated for millions of businesses. They just make a Facebook page (or maybe a Shopify/Wix site) instead.

Please don't edit your comments to the reverse of what they said earlier.

Reply on news.ycombinator.com