PHP Is Web Shell | Hacker News Reader

PHP Is Web Shell

hiandrewquinn.github.io

27 pointshiAndrewQuinn35 comments

PHP is reliable and sturdy. It's also really good.

I have some experience with other languages. I cannot think of any other that is "better" in the same domain. (Bash or F# are "better" but in a different domain).

Javascript has a lot of things I love, and I wish PHP would copy. But I rely on my Nginx/PHP pages more than on my Node/JS pages, and after a while I realized that PHP made better decisions, overall, for back-end.

I have a love/hate relationship with Python (I like the indents; I don't like the virtual env, etc. unpopular views) but PHP is faster, has much more ready to work without hassle, and borks far less.

Took me a moment to understand they mean "shell scripting language for the web", as opposed to "webshell" as in remote command execution interface.

https://en.wikipedia.org/wiki/Web_shell

In surprisingly many cases, PHP is a web shell and a webshell at the same time.

It should not be very surprising considering the amount of vulnerability scans that have all internet exposed sites for several php applications and related patterns. It have the other kind of rot, if it was sitting there for long enough time without updates probably it is used by bad actors.

Nope. The incidence of vulns in freshly written vanilla PHP is higher than any other web-dev language I've seen. The reputation is deserved, and existed since before it stopped being a trendy language.

Skilled PHP devs know to avoid the footguns, but that doesn't mean they aren't there.

Meh, JavaScript has a completely different footgun: Pulling in third-party dependencies for even basic tasks; hundreds of them for even a simple application. You've replaced the risks in the language itself, with increased risk of supply chain attacks.

I don't know if I'd call it a "web shell", or what that would really mean. It's a dsl for content generation that got not enough up front thought followed by an unreasonable time and human suffering investment.

It's in a better situation now than it was. I hope.

You can write crap in any language. Or at least I can.

The Silicon Valley / Hacker News Paradox: ~80%-90% of companies in this world are still using PHP, Perl, Bash, COBOL, Fortran, and C - all without fuzzers, automatic testing, or CI/CD. There's also no shortage of Bootstrap, XML, jQuery, jQuery UI, and pre-HTML pages in this world. (Heck, macOS still ships XHTML 4.01 pages as part of the Screen Time system, right now.) You also seriously do not want to examine how much stuff which still relies on Internet Explorer is out there in corporate IT - there's a reason why Microsoft kept it for so long and still has IE Mode in Edge.

We can't all be elitists and chronological snobs enjoying Rust, Ruby, and Node and bragging about how this is the only good or practical way to do things.

Yup. There's also a ton of legacy Java and ASP/.NET stuff out there in my experience.

Can't really speak to Java, but ASP.Net, in its new open-source friendly incarnation, is perfectly viable for modern development (and there's still nothing quite like Blazor Server). They have a good story for integrating the new stuff (e.g. Razor Pages) with legacy code, interop and drivers for everything, the CLR is fast and multithreaded (cough Python cough), and F# is available for us language snobs. Just avoid the enterprise cruft and the Azure cost (and complexity) premium.

I had a kneejerk reaction to this — no way 90% of companies use this! But you could be right. I mean, 43% of the web is wordpress

43% of the web is WordPress.

PHP, which WordPress is built on, is on somewhere between 70%-80% of websites in total. Websites you may not expect, like Wikipedia, Facebook (with a modified dialect), Etsy, and Slack have large PHP Codebases. As well as the 11th and 15th most visited websites in the world which are almost entirely PHP but, em, NSFW [1].

COBOL is still running every major bank, right now, as well as the IRS. Visa and MasterCard are still running on their IBM Z mainframes.

Heck, not even DOS is gone. I've seen updated DOS programs running the registers at McDonalds in my area. Our midwestern regional hardware store brand (Menards) openly uses DOS programs at almost all of the employee kiosks for looking up information. Don't believe me? Here's a reddit thread about someone criticizing replacing System V at that hardware store branch (which covers MN, WI, and Iowa). https://www.reddit.com/r/menards/comments/t5czy3/system_vi/ and https://www.reddit.com/r/menards/comments/11lb6pf/there_is_a...

[1] Anyone who says PHP doesn't scale - point to, well, any porn site, as well as Wikipedia and Etsy, and you'll have proof it's completely BS.

Are you sure that's DOS and not just an ASCII terminal-based (or cursors) UI?

Technically, it runs in Windows now, but on DOSBox or another DOS-emulator. While I can't prove it, a web search suggests that, just as it looks, it's over 30 years old.

https://www.reddit.com/r/menards/comments/rgc2ux/question_ou...

I'm going to make the bet some critical functions that are foundational to our society (no matter where you live) are written in Visual Basic, most likely an Excel Macro.

Haha, true. I just recently wanted to make a quick and dirty page that would calculate the middle point of a bunch of coordinates and then show it on a map. After contemplating how to get started I remembered that the server is running mod_php. 10 mins later and the (ugly as heck) page was working. The map stuff was client-side JavaScript from GitHub, the coordinate calculation were less than a screen page of PHP (of which most was HTML and CSS).

I actually stopped using bash for shell scripting and started using PHP, probably about two decades ago. It's not for everyone - I never got fully fluent in bash, so find it a million times easier to write shell scripts in PHP, and can use a lot of the dev tools I would use in webdev.

JavaScript and PHP are probably the 2 most unfortunately successful web languages. Things would've been very different if TCL was the language in Netscape and mod_tcl was shipped with Apache and part of the standard install for web hosts.

I think that's a bit silly to say. We don't know how the web would have evolved without these languages, but it's pretty evident that modern web development has had some sizable influences on programming in general, and it wouldn't have happened without it's humble beginnings.

I also suggest both languages have evolved quite a bit since. Between these, though, I think modern JS has had the most impact. This can mostly be attributed to the node community, with a great deal of insights from ruby.

Things like async patterns and quality package management have changed our standards for what we expect out of modern languages, despite the coerson based parlor tricks chuckled at by those who don't use the language.

PHP, on the other hand, is still a templating language that lives and dies in a request response cycle.

The evolution of JavaScript has been astounding. It's just a shame we didn't begin from a slightly better starting point.

The point the post makes is valid, trusted, tried and true boring solutions do one thing very well: they are reliable, they work, they ship.

But there's a different take:

I've written a lot of bash shell in my life, but at some point I quit and moved over to Python. Having a decent programming language makes building any kind of workflow so much better, easier, prettier, more readable. Anything beyond 10-20 lines becomes Python. Every single time I think 'nah, bash is good enough' I come to regret it.

I wonder if and what the equivalent analogy with PHP is.... ;-)

The problem I keep hitting is that the standard library of <language> is frequently not as strong as GNU, so then I install a bunch of packages globally and its a mess.

Edit: I think there's room for a language with modern control flow that just wraps bash. Like if (true) { cat("path") }

A virtual env works fine for this, there's no real reason not to use then in my view.

But that's a lot more work than a simple bash script

Python -m venv dirname . dirname/bin/activate

I beg to differ

The boilerplate can be a bit ugly, but you can invoke CLI tools from python just fine.

The result is not particularly "pythonic" but I think it beats a pure bash script if there's non-trivial business logic.

PHP is a scripting language and so is Bash. Both focus in different use cases.

The observation "PHP is web shell" does not seem very insightful or interesting.

The article needs some examples. I wouldn't call doing a curl call in PHP particularly comfortable. Not something I'd want in a shell. :-)

> The article needs some examples. I wouldn't call doing a curl call in PHP particularly comfortable. Not something I'd want in a shell. :-)

There are a couple of other ways to make web calls in PHP that don't require curl (which I agree is a bit confusing if you're coming in cold - I've been doing it for decades and still have to look up the docs every single time).

If I need to do a basic kinda GET request you can simply call file('https://example.com') to pull in content from that URL. fopen() also supports URLs.

I do this in shell scripts (and "web shell" as the author calls it) all the time.

The good old days of dropping a c99/r57 on a website and enjoying being a god over the entire server.

I get that "web shell" in script-kiddie land has a specific meaning, but that is not what the author is talking about. They're just talking about how PHP, for many seasoned engineers, functions as a quick-and-dirty tool for getting things done and running quickly, much in the same way that shell scripting does for Linux ops.

Right…

> That pink stuff…

If the author means the logo, they should schedule an optometrist visit

The only things they have in common is that they are easy to use and somewhat uniquitous.

But then again you use shell because it works _everywhere_ and that is not true for PHP. PHP is evolving and unless you take some really old code and throw it in a new runtime, nope. People write PHP in the 2020s decidedly different than in the 2010 or 2000s. My bash scripts from this year are working on ancient RHEL machines. And overall I'd say it's very, very hard to write well-tested easy to maintain software of a certain size in bash, whereas in that regard PHP is just another regular programming language.

Reply on news.ycombinator.com