Hacker News Reader

Comment by kuroguro | Hacker News Reader

If you use any modern framework you're mostly covered. SQLi gets handled by ORM and XSS by the templating system which should be "secure" by default.

SQLi has been made harder to pull off in the language itself too as all DB queries run trough the PDO interface (for more than 10 years now, I think?).

Oh and let's not forget the magic quotes... been gone for a very long time but I still get nightmares about that "feature".

The problem used to be that PHP itself started as a templating language - you were supposed to mix HTML and PHP in one file. Easy to do and easy to make bugs. These days almost no one writes a large project without a decent framework.

I'd say both the language and the ecosystem of libraries/frameworks have matured a lot over the years but you still have to follow best practices just like any other language. I highly doubt other languages are more "secure" by default.

View on HN

> you were supposed to mix HTML and PHP in one file. Easy to do and easy to make bugs.

I maintain a large project (inherited) that has that; cannot say it's been that bad in my experience; it has been running for 20 years and used (internally and externally; it's a crm/erp/everything system) used by 1000s daily; no significant bugs have been reported and adding/changing features is fast and painless. I sometimes wonder if that over-architected stuff we have been taught really is much better. For most things here I change one (or 2) file, test, deploy, done. For most other stuff I maintain, for every change I have to change 5-10 files all over the place (service layers, data layers, migrations etc) and the result is not really better (I would say actually worse generally). It's not really apples vs apples (for starters, it is only used by this company and it's partners, while other systems are running publicly and have far more users and people trying to hack/break things) but this old system is causing me far less headaches than many others while it's far larger and more complex functionality wise.

Edit: many companies came in 'offering' a rewrite but yeah.. This costs nothing to host and barely anything to maintain (compared to the revenue of the company) ; all other solutions or rewrites would cost a lot to create/set up and then a lot to run/maintain as well. It's a good example of a company that would be insane to 'go cloud'. Not many benefits but a nice bite in the profit.

I don't think there's a good argument to justify mixing PHP and HTML...

Unless you're on your own, how do designers touch the HTML without confronting some PHP code?

Also, you should be using a better templating engine and it's not possible to do so if you mix HTML.

I never used PHP so correct me if I'm missing something here, but "you need to use a framework to build good applications in PHP" (which kinda implies that it is hard/impossible otherwise) doesn't sound like an argument in favor of the language.

I am not a PHP fan. However, in what language does one not use a framework to build applications?

I never use one. I have my own scaffolding code that does better than anything else for my use.

Much faster without unnecessary processing that I never use, no weird rules on routing but it's all linked to file name, so it's easier to figure where to look and no ORM but plain SQL that is easier to optimize and know what's going on and it has multi site capability and they're all hosted under different sub domains to keep clear separations of what code is shared and what isn't and lastly logging is far better as they're grouped together by access and not just display logs of different accesses all mixed up which is useless.

If you know what you're doing, frameworks drag you around for no good reason. The only reason I'd use one is if a team wants common knowledge to develop it but otherwise I never want one.

And you mention "any application"? Why would any application not be built without using a framework? Unless you mean libraries that link to your app and not something you base your whole app on.

I would grant that point if PHP's main focus weren't web applications. One would expect the language to bring everything you'd need to build a web application. (again: maybe that's just my perception of PHP but I don't think there are many other kinds of application, PHP is used for)

Many. Clojure/Script applications tends to favor your own composition of libraries rather than a full-fledged framework. Golang is (at least used to) the same as well.

You're spot on. PHP is really bad, but zillions of hours have gone into tools around and on top of the language such that it's actually not that bad to develop in anymore.

Why was all this time spent on PHP instead of doing anything else? I don't have a clue.

That makes me wonder: why do you spend so many hours badmouthing PHP in multiple threads on here? Why isn't that time spent on something else?

Being on Hacker News is leisure time. If you work on making PHP suck less purely for leisure, I reserve no judgement. If you are a Laravel author, my question stands.

The answer is the same reason you build anything: there was a need for it, especially in the early 2010's for the language.

Reply on news.ycombinator.com