Hacker News Reader

Comment by KerryJones | Hacker News Reader

As someone who has programmed PHP professionally for 13+ years (and also JS and Python) I have never run into anyone who can place a solid argument since the PHP 7 + Laravel.

-- Let me clarify, PHP is useful with context. For building web apps. Each language has its best-uses. Laravel has the strongest ecosystem and community out of any language/framework combo I've seen.

I can literally setup and deploy a laravel application on a horizontally scaled setup with CI & autodeploy within an hour -- while maintaining industry standards.

PHP had its problems -- historically, but so did most languages. Do you remember Javascript before Node/React? Or before jQuery/Prototype? It was _trash_.

The biggest "con" to using PHP is that it's "bad" for the resume, no one is excited about it, so when looking to hire for it, most developers don't feel inspired by it -- which is a serious consideration depending on your circumstance.

View on HN

All my projects require PHP 7.4, and it's such a joy to write the modern almost-strict typed, namespaced, and code that is often inter-operable, tested with a nice testing framework, and managed with an excellent dependency manager.

I have my reservations against Laravel though. Its excessive use of static methods is not my appetite, and its rapid release cycle gives less headroom to keep track in contrast to Symfony for example, which follows Semver strictly.

What's wrong with the static methods? And do you mean beyond helpers?

Laravel gets a major update about once a year from what I've followed (disclosure: I've been to Laracon twice, you could probably classify me as fanboy) -- I _haven't_ used Symfony, but I have enjoyed the rapid release cycle of Larave. It also generally takes 20-30 minutes to update to the latest major release, and if not, there is a service for $10 or so to update it for you

> Do you remember Javascript before Node/React? Or before jQuery/Prototype? It was _trash_.

Anyone remember Dynamic Drive DHTML? http://dynamicdrive.com/

Ha! I recall Dynamic Drive.

Javascript is still trash. What with the insane amount of configuration and build tools, extremely small standard library forcing you to use third party modules which may or may not have tens of security issues and the dependency hell it brings with it. I can go on and on.

I was raised in the darkness, so things don’t often look as bad as they are to me. Regardless, the clear distinction between PHP and JavaScript seems to be that I can choose whether or not I’d like to use one but not the other (and no, wasm doesn’t count because it still requires JS).

For me, I just don’t why I’d choose to use it for a green field project. Sure, it’s better now, but people have warned me to stay away from the boogeyman lurking within. Maybe it’s there, maybe it’s not. But why should I take the risk if it’s pretty much the same as other modern languages that might have cool stuff.

I agree to the point you're mentioning industry standard. PHP is not considered in the enterprise environment, simply for all it's flaws and it's security vulnerabilities and still has the same problems as before. Most languages don't have those problems.

PHP as a language had inherently insecure designs such as register_globals and RCE in unserialize().

When working on reviews, it's often as easy as grepping for "unserialize" and working your way from there for an easy bounty.

However, PHP has matured a lot. There is not a hint of register_globals as of now, and we have proper serializers, in addition to RCE-free improvements to original unserialize().

With native support for proper password hashing, sodium, and other improvements lately, one could argue that PHP is one of the most secure languages out there.

Reply on news.ycombinator.com