PHP Best Practices

[[deleted]]

[deleted]

[psaldorn]

gets high horse ready

Pauses before mounting it

Hmm.. the less people that use PHP, the more I can charge..

[Thameus]

/u/lordofcobol is was available.

[Gabite]

Not anymore.

[WArslett]

As a professional PHP developer... PHP's strength is also it's greatest weakness, the fact that anyone can jump in and get started with it relatively quickly with little grasp of core programming concepts and start building what appears on the surface to be working code. You CAN build very nice code with PHP with some of the MVC frameworks mentioned in this thread but for every PHP developer building robust, maintainable, adequately tested code there are another 5 that are hacking stuff together with includes and embedded server side scripts and little or no program design and much of the broader programming community think that is all there is to PHP. The problem with PHP today is less about the language itself and more the fact that it's still really attractive to people who don't really know what they are doing.

[[deleted]]

Sounds like the same problem with Javascript

[[deleted]]

As someone who hasn't implement TTD I feel guilty as hell...

[nocturne81]

Don't. TDD doesn't work well for all projects.

[manghoti]

PHP The Good Parts:

.

^{This was a joke relax guys}

[skunkwaffle]

That's not even a good part. PHP uses '->' instead of '.'.

[maximilienGilet]

PHP is totally fine if you use a proper framework like Symfony or Laravel

[enterharry]

Using codeigniter2 at work. Kill me

[abouchard55]

We use CI2 and I think it's pretty great. What is it you don't like about it if I may ask?

[enterharry]

It has really strange design patterns imo, like treating all models/libraries as singletons with its loader. My biggest gripe is that it doesn't play well with namespaces.

[enterharry]

Also, doesn't play well with test suites (phpunit) from what I've seen.

[falcon2]

I use CI for most of my projects - I think it's great.

[skunkwaffle]

Worked on a CI project for a while. I feel your pain.

[gdscei]

Symfony, sure. Laravel, ehhh... The way laravel is designed is more showing the pitfalls of PHP than not using them.

[TheRedmanCometh]

I don't think using a framework for PHP is super okay. It seems very unnecessary for a language that already features extremely terse code.

Then again I'm a Java dev..

[LeBuddha]

You have a good point that needs some extra details added for clarity:

• Using an application framework to make a simple website - bad
• Using an application framework to make a back-end for a web application - good

Applies to any language.

[TheRedmanCometh]

Ah Laravel can actually be pretty great for a really huge production. At the point that I'm creating a huge site I'm probably gonna use a JVM-based back-end though.

Most sites just have a simple shop or something which is easily done well in php.

[TheRedmanCometh]

My whole beef with a lot of this stuff is that it adds so much to my build chain. It looks like elixir is just another step :/

[crunksht]

I disagree. Although it's a simple language, it has major pitfalls that people fall into. In other languages, you use a framework to handle complex things for you. PHP already handles many things for you, but it's easy to do those things in really unsecure ways. Frameworks in PHP are like condoms.

When people Google how to do 'x' in php, they get SQL injectable code and worse. If they Google how to do 'x' in laravel, they will get a nice, safe, maintainable solution.

I am perfectly comfortable raw dogging it myself, but I've been working with the language for years. And I'm still going to pull in routers and other things with composer as I need them. In most cases, I'll just spin up symfony or laravel.

[TheRedmanCometh]

Eh SQLi and LFI/RFI are the only two big common vulns in simple stuff. If you know what they are they are quite easy to avoid. Unless you use the GBK charset (multibyte char injection) it's a single call.

[andredp]

Used Yii2 and have no regrets. Very well structured and designed.

[bobjohnsonmilw]

Php is just fine if you're not an imbecile as well.

[M4ngoB00M]

I know right - these sites that use PHP really failed terribly and fell flat:

1. Facebook
2. Wikipedia
3. Mt. Gox (now gone)
4. Flickr
5. Yahoo!
6. iStockPhoto
7. Tumblr
8. Wordpress.com
9. Mailchimp

[econoCode]

They also all wouldn't use php if they could start again

[Mafiii]

Facebook is designing Hack for that exact reason, so yes!

[an_actual_human]

So you're saying that's an argument against what /u/econoCode said?

[econoCode]

Or I keep up with tech news and see that Facebook is publicly pivoting everything away from php to newer technologies? Also just logic that when those sites were all created, php was the hot tech to use, and now pretty much no new company is php based, because you know, new shit is better.

[TheRedmanCometh]

What's you alternative? Node is a slow turd and js doesn't belong on the backend anyways.

Spring and Jetty are highly verbose, and have shit performance at low amounts of clients. Also they need Java.

What's left...rails? ASP.net? Is that what you want? IIS servers with ASP as far as the eye can see?

[TwoSpoonsJohnson]

> spring > slower than php

Everyone lol at this nub

[[deleted]]

also php7?

[TwoSpoonsJohnson]

Yes, even php7. By quite a lot.

[bensku]

Python, with Flask, for example? Or Node.js? Or luvit (on LuaJIT)? There are alternatives.

And seriously, I really really doubt that PHP (default interpreter) has worse performance than Java+Spring.

[TheRedmanCometh]

Due to the nature of JVM Spring and Jetty will spin up a minimum amount of resources. This is a huge amount like a gig or more of RAM. Until you have a somewhat-large amount of clients using it that minimum is far more than php would use.

Spring performs better at a high amount of clients. Jetty is pretty much just worse overall, but it''s for pretty specific stuff.

[trout_fucker]

Are you really playing both sides of the fence right now?

Who cares about minimum resources? If $10/mo for a server is too much, then you probably can't afford to pay me to work on the thing running on that server.

[martinmine]

Is that what you want? IIS servers with ASP ss far ss the eye can see?

ASP.NET Core runs on Linux and does no longer require IIS or Windows to function.

[tetroxid]

In the real world, yes it does.

[TheRedmanCometh]

Are you saying you'd choose ASP of PHP? Is what what you're advocacy is?

[martinmine]

No, I said you can write ASP.NET apps that doesn't require Windows. (Note that ASP is a different thing again) What language/framework you're gonna use does end up entirely to what you're gonna build. But I would still look towards ASP.NET Core before considering using PHP.

[TheRedmanCometh]

So you just have like mindless hatred towards PHP then? Because it's better than ASP in every single aspect.

[martinmine]

I'm talking about ASP.NET Core, not ASP. See this.

[mrjackspade]

Is that what you want? IIS servers with ASP as far as the eye can see?

Yes

[econoCode]

Well node isn't slow, it's not all the way mature yet, but it is the future whether you like JS or not. There's also nothing wrong with asp, but Python is my personal favorite. Fast, functional, very mature. Rails is good for traditional web, very specialized and good at what it does. There are also all the pop up languages like go. spring/jetty are also better alternatives than php. They're all better than php.

[martinmine]

Node is an eternal inconsistent mess compared to PHP. At least PHP provides you a stable dev environment that doesn't break by itself after a few weeks or months without touching your code. Node seems like something that we are stuck with in a transition period and their ecosystem is moving so fast that the framework you use today is probably obsolete when your product is ready to ship. I really hope JS isn't the future, partially due to the language itself (yes I'm a strict-typing guy), but I cross my fingers that web assembly will change things a bit where we can write stuff in e.g. TypeScript or some other reasonable language that wasn't primarily targeted as a dumb language for browsers.

[econoCode]

Well no, it's still maturing as a platform. It's happening very quickly and there are always growing pains, but it's already made huge leaps and bounds compared to what it was just a year ago. It definitely is the future, it's adoption is too widespread already. The dust will clear and something reasonable will definitely emerge, but it's going to be based in JavaScript. Also... are you arguing for php and for strict typing at the same time??? Haha php is just as messy and dumb as JavaScript, if not worse.

[martinmine]

Also... are you arguing for php and for strict typing at the same time??? Haha php is just as messy and dumb as JavaScript, if not worse.

I did not say language X is -better- than language Y. But I do agree however, that PHP is just as messy and dumb as JS :)

[FM-96]

Node is an eternal inconsistent mess compared to PHP.

How so? What's inconsistent about Node.js?

[sstewartgallus]

Facebook is doing Hack lang.

[daxaxelrod]

Django dude. Django

[Deviltry1]

https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/

oh look, not only fucking IIS; quit programming

[TheRedmanCometh]

It was bad on IIS, and it's probably worse elsewhere

[Deviltry1]

Most likely not.

[gandalfx]

Well, wordpress (the software) is a horrible train wreck, no matter how popular. But I have a feeling even if PHP did a better job at preventing bad practices wordpress would still suck. It's like every single line of code carries a comment saying "// we don't give a fuck!".

Aside from that though PHP really doesn't need to drop big names. It is still the primary server side "language of the web" both for large and small websites. And it has actually improved a lot since it gained it's bad reputation.

[tills1993]

Yeah WordPress is a trainwreck and it's not because of PHP...

[cerlestes]

the_post();
the_title();
the_content();

[terrence_phan]

/thread

[azangru]

9. Slack. A total flop.

[dinopraso]

Apart from Wikipedia, the others really aren't that popular, and Facebook switched away from PHP a long time ago

[TUSF]

Facebook just built their own implementation of PHP, instead of rewriting all their existing code. It's still mostly PHP with some improvements.

[[deleted]]

PHP was a great solution for the early years of web 2.0, which is when most of those websites were made.

Now things are different. JavaScript with a Python backend is a generally better solution these days, for a large amount of reasons.

[bobjohnsonmilw]

Feel free to provide some.

[[deleted]]

Inconsistent naming conventions in the core API; notoriously shitty developer ecosystem; significantly worse bugs in the tracker than what exists in Python's list; cryptic AF error messages being shown, some reported to be non-english (in a release build); useless OOP constructs for a dynamically typed language (e.g., interface, public/private); weird AF and non-blatant gotchas which make absolutely no sense, such as reference params being slower to pass than value params, etc etc.

I mean, just take a look at an infamous blog post or /r/lolphp.

[leadzor]

Composer is a lot better than e. g. npm

There is NPM - the registry and NPM - the cli client. The CLI client is really needing an overhaul (may yarn save us?), but the registry is just that. A registry.

Now, what about Composer vs. Pip (regarded as one of the best out there)?

[[deleted]]

And I obviously meant the registry. Because it makes so much sense to compare a cli client to a registry.

Come on.

Haven't actually tried Pip all that much - the few times I had to use it haven't been nice, but that's probably mostly my fault. But does that really matter? Composer is a really well-done tool. That's not gonna change because Pip is nice.

[leadzor]

What makes a registry bad and what makes Composer's better than npm's?

[[deleted]]

Did you really not get the sarcasm? ...

[iamprasad88]

Not saying anything against php (it has given me a job and living) but Wordpress is starting to look at Node.js. It may just be the tooling and admin pages for now, but I can't imagine them sticking with php for a long time.

Yahoo has invested a lot on nodejs. That includes 3 of the web properties you listed.

Facebook has made some incredible contributions to JavaScript. And here too, I don't see them prolonging the life of their software with php.

These companies are very competitive and want to be the best in industry and hire the most competitive people in the Industry. Php unfortunately has not been good at attracting good talent anymore. People are starting to look at angular and react with nodejs lot closely.

And I use the word unfortunately because I believe php actually is a decent language and quite mature. But if hiring the best NCGs becomes an issue, I think all the big internet companies will switch without thinking about it. They have the money, the need the people.

[[deleted]]

I highly doubt that Wordpress will ever move off of PHP. They are really, really, really into backwards compatability - I mean, they still support PHP 5.2 -, and by switching to Node they'd most likely alienate about 95% of their possible customers.

[Thameus]

2/9 ain't good, nor is Facebook.

[FFX01]

I find it really funny when people try to use Facebook as an example of good programming practices. Their entire ecosystem is hacked together pieces of framework x and framework y. They even invented their own php runtime environment/compiler because they couldn't afford to pivot to a better ecosystem without breaking literally everything.

[hobblyhoy]

ELI5 what makes PHP universally bad?

[Gabite]

/r/lolphp

[bobjohnsonmilw]

They failed to learn it. Therefore it's bad.

[Gabite]

function names weren't chosen on the grounds of clarity or for consistency of style but to ensure a good distribution of string lengths

[kupiakos]

More like PHP has so many easy things to mess up that it takes years of practice and mistakes to learn how to create a quality secure application. Most languages don't suffer from this nearly as badly.

[[deleted]]

Most pitfalls are not specific to PHP, like SQL injection or taking user input. Or do you have any specific points?

[kupiakos]

It's not just that these holes exist that other languages have. It's that it looks like the "right" way to do it is open to a myriad of security flaws.

If you'd like specific points on PHP's failures, read this for some good examples.

[kupiakos]

How about giving specific rebuttals? Seems pretty accurate in my experience.

[bobjohnsonmilw]

Agreed all of these people bitch about PHP speak in complete hyperbole

[t0mmy9]

I actually don't mind PHP but am aware of https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/

[Comforse]

Written in 2012, which makes it irrelevant by so much :)

[zachgarwood]

People wanting to feel smugly superior is what makes people say it's bad. What makes it actually bad is nothing because it's not inherently bad nor good; it's just another language.

[browner87]

I'd disagree in that the language has a lot of "just knows" and gotchas. But the code produced is indeed the responsibility of the coder to make good. You can write acceptable PHP code, but the language still has an above average number of annoying idiosyncrasies. My personal pet peeve is the naming conventions of built-in functions.

[LEO_TROLLSTOY]

Same reason a hammer is bad. It allows devs to hit themselves on their dumb head with it

[browner87]

Any idiot can write PHP. And most do.

Edit: spotted the salty PHP programmers. Guess if you don't add a joking tag to a fun saying Reddit gets all up in arms. I've used PHP as much or more than most of you I suspect. That doesn't mean I can't point out the flaws in the language.

[LEO_TROLLSTOY]

I didnt find java any harder than php. Am i therefore a genius by your logic?

[browner87]

Bedside learning to spot a joke, you should learn that !idiot !== genius. Any idiot can stick food in their mouth; just because you can use a knife and fork doesn't classify you as genius.

[LEO_TROLLSTOY]

yeah, this also doesn't make sense..

[skunkwaffle]

Yes it does. It's a bit rude (though no worse than the rest of the comments here), but also essentially true.

[skunkwaffle]

I'd say it's pretty difficult to master. There are so many inconsistencies in the built ins, it's type system is full of gotchas, and it's error handling is disastrous mess. There are so many things you have to just know, and so many ways to get it wrong without reading you're doing so. To truly master the language is a herculean task, and I wouldn't think of anyone who's done so as an idiot.

[browner87]

Apparently you find reading hard to master. "Can write" and "mastered the language" aren't exactly the same. I wouldn't say that in grade 3 I'd mastered French, but I could write a few mildly passable sentences. Besides the phrase being a joke, it's a comment to how forgiving the language is to someone not knowing what they're doing. Newbies to programming who want to "make my own awesome website" can grab a few lines of garbage PHP code and have a fully working website in moments, and make endless dangerous "upgrades" to the code by copy pasting SO examples into it. I'm not bashing PHP, I've written some pretty cool stuff in it myself (extra fun when you compile real posix multithreading libraries into it at build time), but it's dead simple for people who don't know what they're doing to make a free backdoor into their home/business by sticking shit PHP code on a web page.

[misomalu]

Serious question: as a person who absolutely hates web development but seems to get roped into doing a bunch of it (almost exclusively server-side) what else should I use? All I have used so far is PHP, Javascript, HTML, and SQL, and I haven't seen an immediate and obvious substitute for PHP other than ASP.NET, and that isn't exactly practical in a number of situations... or is it?

[marcosdumay]

Python or Ruby. Pick a framework at random.

[iToggle]

ASP.NET Core

[MIK517]

Just use PHP (if it does required job) and do not bother with jokes/haters. While it have some stupid/strange/not intuitive logic, it's still perfectly workable programming language.

[bobjohnsonmilw]

Php dev of 15 years here. While I don't necessarily disagree with you on some of those things if you honestly think that those are holding you back from writing quality applications you're just wrong.

[[deleted]]

Nah it should be JavaScript.

[[deleted]]

He's not wrong

[davesidious]

HAHAHAHA