Also I'm 97% sure I could own your site in under a day, based on how home-baked you just said it is, and I'm garbage at pen testing.
Healthcare site, you say? Jesus Christ, I hope they have data breach insurance.
Thats from someone who does that for a living.
Modern web-devs move faster than they think, leaving so many doors open. Someone who works on the same system plenty of years had time to patch the doors.
But am I not right to have red flags fly when someone says they built a home-baked web service for managing health care information? Isn't that nuts, from a security perspective?
SQL escaping, session handling, etc all come easily with standard php libraries. So "I didn't bother with any PHP frameworks" doesn't mean the dev wrote an SQL connector.
There are a hundred examples that are specific to whatever app this guy built for the Healthcare company, not all of which are covered by the PHP standard library...
I believe him when he says it passed external/internal auditing, however I have a very hard time believing he's not either very very expensive or took a very very long time to get the app to the place he claims it is (the third option is that it does very little, which won't actually end up being a good thing once the client gets over the honeymoon phase of "it's so much prettier!!!").
Further, the expertise I do bring to this conversation is in software development, and I can say assuredly that a one-man development team using no 3rd party libraries is definitely creating a codebase nigh unmaintainable by other people down the line. His bragging about creating job security for 2 years is honestly an understatement; he's got job security for the life of the products he's creating, as he's likely the only person who can do anything more with the website in a time frame that isn't measured in years.
https://www.php.net/manual/en/password.installation.php
"There is no installation needed to use these functions; they are part of the PHP core."
The functions are common knowledge in the community, and made to be easy to use.
> Further, the expertise I do bring to this conversation is in software development, and I can say assuredly that a one-man development team using no 3rd party libraries is definitely creating a codebase nigh unmaintainable by other people down the line.
They said, "No frameworks." They didn't say no libraries. Some people make a distinction between the two, others don't. You are taking the stance that they mean they mean the same thing. Realize that others don't consider them the same thing.
Further, the expertise I do bring to this conversation is in software development, and I can say assuredly that someone who doesn't know the nuances between libraries and frameworks in the software development world can't make the claim to have expertise in the software development world. =)
I think it is, especially since you are nitpicking on it. I'll explain.
If the original poster is using libraries but not frameworks, and feel there is a distinction (and judging by the post, it's clear they feel that way), then they are using libraries, just not frameworks.
Therefore, when you say this: "a one-man development team using no 3rd party libraries" in the context of the discussion, you are making stuff up. No where does the original post suggest or otherwise say that they aren't using 3rd party libraries (quite the opposite).
For your comment to hold up, you need framework and libraries to be the same. However, by pointing out that often times developers see them as different (generally libraries make up frameworks), I'm making it clear that your conclusion is misinformed.
> I'm pretty sure that your failure to address the "this is but one of hundreds of examples, not all of which are covered by standard libraries in PHP" comment I made is further justification of that belief.
I addressed directly the one example you provided. You didn't provide hundreds. You provided one. I provided the answer out of courtesy, as you asked a direction question. Saying answering your direct question is justification of my dishonesty is insulting and childish.
Further, the fact that you are mistaken on the concept of the common use of library vs framework, I felt that your claim of "hundreds of examples" was hyperbole and ignorance. Maybe you can provide hundreds of examples where PHP and libraries written in PHP cannot solve problems that only fully fledged frameworks can provide? Keep in mind that libraries exist for many different things and since frameworks are made up of libraries, there is almost nothing relevant that a framework can do that libraries can't.
You would need to implement whatever custom code required or use a libruary. You would need to do the same with a framework. No framework offers business health care functionality. Do you think laravel has an ocr skin cancer detector package?
PHP is fast to write. Hearing people from the outside saying its impossible to write a php site that quickly makes me laugh. PHP makes development easy.
A lot of bad software engineering going on in these comments, downvotes don't change that...
Yeah that's odd to me too. I mean, that's pretty much the biggest argument against using PHP (well it was, back in the day). Bad sites written easily by inexperienced programmers.
It does, actually: https://www.php.net/manual/en/intro.password.php
The internal and external security audits already performed by the billion-dollar healthcare company in question disagree with you.
If it's simple enough and they understand PHP well, it could easily be better.