Comment by PaulHoule | Hacker News Reader

Comment by PaulHoule | Hacker News Reader

Parent Full thread

"designed specifically for web scripting" is worth a lot.

PHP's standard library has a function called htmlspecialchars() which escapes special characters in HTML. If you don't use a function like this, your HTML forms can be destroyed by ' and " characters and crackers can f- up your web site by putting <script> elements on your pages.

There is no function like this in the Java standard libraries. Nothing like this comes with JSP or JAX-RS. You can get one in the Apache commons lang project, but a Java web developer who doesn't know this (or write his own) is in deep trouble.

PHP is a great tool; it's creators have gotten many details right, and it offers developers the chance to get started without running into gotchas. On the other hand, other languages have things going for them too.

Ruby gems and Java's maven are incredible package managers that put PEAR to shame. There's a lot of junk software written in Java, but some of the best open source projects are there too. People are doing interesting stuff in web frameworks in Python, Ruby, Java, C# and many other languages, even PHP.

I basically read this as, "I want everything I could every possibly use in the global scope so I don't have to think about imports". Modern web development revolves heavily around open source frameworks. You can't escape the need to know about libraries outside the core language you program in, even with PHP.

If you are writing a trivially simple webapp, then you would be correct that you could hack together something with just the core language features of PHP.

Who cares if it's in a "standard library", as long as it's available in a library?

but you have know about it, and Java programmers have a lot of things clamoring for their attention. Programmers in all languages, including PHP, fail to escape characters correctly. But PHP programmers have no excuse: you can tell them what to do and they don't have to mess with the build system, think about licenses, all that.

In a large Java system, you might find you're using 4 different JSON libraries... because 2 of them are used by other Open Source projects your project uses and 5 of your subteams picked 2 different JSON libraries.. Now you've got to deal with bugs in 4 different libraries and if you're doing cross-functional coding you've got to know the idiosyncratic APIs and you can always get your panties in a knot about which library you should use in who's turf.

PHP programmers use json_encode() and json_decode() and avoid bugs and wasted time.

Modern frameworks and platforms have incorporated and improved a lot of ideas (some would consider) made popular by PHP. Spend some time getting to know Rails for instance and you'll find that none of the problems you just described apply, and they've solved the same problems -- but better.

No need to manually escape strings, no build system, 4 different JSON libraries!? Seamless (you don't even need to call it most of the time) to_json. The list goes on.

Yes, you have to know about appropriate libraries to use Ruby for webapps, just like you have to know about the functions available in PHP. It's fortunate that PHP has some of that core stuff built in, because it's package manager blows. If I need to encode json I just incant `gem install json` (but it's probably installed already, or maybe I would have to start right at the beginning with `gem search -r json`?) and call `to_json`.

The point is, use what makes you productive. Not being 'designed for web scripting' is meaningless today.

rails 3 makes strings safe by default. PHP doesn't.

Rails 3 is a web framework. PHP isn't. I am always puzzled by the apple to oranges comparison: Rails vs PHP.

I normally would agree. But I think this is a unique discussion because the OP is asking why he should use something other than PHP. One might use Ruby because of Rails. So it's not a comparison of PHP and Rails directly, just reinforcing the point that languages/platforms other than PHP (and it's frameworks) are just as useful for web work as PHP is.

and Java programmers have a lot of things clamoring for their attention

This seems like a great problem to have.

Who would suggest using Java, of all things?

It makes perfect sense to point out that most anyone using a normal alternative to PHP such as Python or Ruby is probably using a framework where output is escaped by default, such as Django. How about that - a system that does it automatically, you don't need to call htmlspecialentities.... or html_special_chars.

Reply on news.ycombinator.com