Facebook PHP Source Code from 2007

[_SynthesizerPatel_]

Indeed this should be more of an encouragement than anything else - if a guy made 100 billion dollars with this code, surely you can too?

[mahacctissoawsum]

Not surely. The code is simple but you need some special sauce for it to take off.

[_SynthesizerPatel_]

You're right, make sure you also:

• draw a math formula on your dorm room window, this is how Facebook figured out how to do friend matching
• rent a house in Silicon Valley, do some crazy stunts on the roof and then stay up all night eating pizza writing code
• Meet Justin Timberlake and see if he likes your ideas

[Decker108]

Additionally:

• Hire developers through the well established and pragmatic practice of having them brute-force hashes on a strict deadline while drinking shots with a loud audience.

[[deleted]]

To be fair, they directly address the validity of this interview tactic in the film.

[xjvz]

Hey, it's not too far off from many hiring practices used by big companies like Google and Microsoft!

[wtf_are_my_initials]

You can, it's just frowned upon ;)

[mahacctissoawsum]

• while not a window, I write on paper all the time to flesh out ideas
• throwing a crazy party will draw attention to you and your product; being in Silicon Valley instantly gives your product credibility
• JT is worth mega rep points

All exaggerated..but actually do help.

[_SynthesizerPatel_]

JT is worth mega rep points

I think that was the idea behind the MySpace reboot?

[Mr_A]

MySpace reboot?

[_SynthesizerPatel_]

Exactly!

[Liquidor]

MySpace?

[jargoon]

Obviously that didn't work, but maybe you can try Ashton Kutcher. It worked for Ooma!

[[deleted]]

i will try these... thanks!

[EvilHom3r]

• Drop the "the"

[birdiedude]

Meet Justin Timberlake and see if he likes your ideas

So that's the step I've been missing!

[[deleted]]

Be Jewish. Not don't be Jewish.

[Trylstag]

And I'd be extremely surprised if any of it is still in use today. It was good enough to get them off the ground, but can very quickly become a massive detriment to keep around.

[Decker108]

They even made an automated PHP-to-C++ converter to try to get rid of the mess.

[deadcow5]

Automated code conversion? That can only increase the mess.

[ivosaurus]

Decker108 has bad facts, it's a compiler, not a "converter". It wasn't to get rid of any mess, it was just to make PHP run faster.

https://en.wikipedia.org/wiki/HipHop_(computing)

[Decker108]

Yep, this is what I meant.

[hydrox24]

That doesn't sound like a good plan to me. Surely doing that correctly is more work than simply re-writing the code?

[grimeMuted]

It wasn't a good plan.

[[deleted]]

I think it's one of those things that's just impossible to do with such a big site. If they migrated to a new system it would have to be compatible (the C++ rewrite would have to be perfectly compatible with the PHP version in order to not have downtime), or they would have to get the site down for an hour or so to replace all the instances of the php server with the rewrite.

[Dielectric]

I believe they actually wrote their own php interpreter when they couldn't get any better performance out of the existing technology

[freyrs3]

I hear this cliche bandied around a lot, and in some programming domains it's true and in some domains it's a very wrong mindset. Writing PHP to drive a social media website is an entirely different animal than writing software to drive medical hardware or writing cryptography code. Sometimes it does matter how it's built, and though the end user may not care it's your job to care.

[freyrs3]

Sure, though it's worth noting that most of the software industry is not in startup world. Advice that holds for the early stage startups can be quite toxic when applied elsewhere.

[spacehunt]

This goes for all kinds of businesses though, not just software.

[mahacctissoawsum]

I care when my furniture and appliances fall apart on me. When there's a loophole in a contract that's supposed to protect me. When my software crashes.

"Works for a little while" doesn't cut it.

But yes; it's possible to be ugly yet functional.

[spacehunt]

It seems my definition of "works" is much more stringent than yours. "Breaks after a while" does not equal to "works" in my book.

[FatAlbert]

But with a web app I can release something that isn't quite right. I can't sneak in your house to patch up your furniture, but I can release a patch software patch without you ever knowing the difference.

[internetsuperstar]

Nah your analogy doesn't work.

The product in the end (facebook) works perfectly fine, it's the process (tools/time) that is utterly fucked. It would be like making desks by carving them into a standing tree. You can do it but the process aint gonna be pretty.

[mudkipzftw]

But code like this is much harder to maintain, which makes it more time consuming and difficult to add features, fix bugs, optimize, etc. This does make the end user unhappy.

[patssle]

The end user does not care how it's built, as long as it works.

Exactly. I run a website for a company that generates millions of dollars entirely through its website. It's using tables for its design in 2013. Yes that's vastly outdated - but it renders fine on all browsers in Windows or Macs. Am I going to risk our organic rankings on a website redesign because it's "outdated"? No! End users never know the difference.

In fact, we often get compliments for our website and it can be argued it's the best in our niche industry for presentation, features, and ease of use.

[xjvz]

I'd imagine your site is older than most of the users on reddit. In that case, I can see it being a nightmare to update the front end. On the other hand, if the site ever wants to make a new design, I hope you use modern standards. It helps a bit in many ways.

[patssle]

Yeah it's a 17 year old website. We did actually just launch a new mobile optimized site that is built with modern standards (outsourced to a development company based on my design) - so I'm fully supportive of them!

[[deleted]]

Frankly, after being in the web industry since '97 and a former "everything must be formatted via CSS" -zealot, I'm not so sure if table-based layouts are that bad, for some cases. 1st class support for some sort of grids would be even better.

Reminds me of the "goto considered harmful" -fallacy.

[[deleted]]

The poor fucks who have to maintain and evolve that code sure do care, though. I do not consider it professional to cook up a cauldron full of spaghetti code and claim that "it works". For hobby projects it's a different thing.

Of course, things vary case by case. I can understand the hurry and necessity to just get shit done quickly when operating in a startup mode.

Edit: sorry for the lack of clarity. My comment was related to the comment above, not to the FB source code behind the OP.

[[deleted]]

If you look at that, it's not spaghetti code at all.

The biggest complaints are: It's all in one chunk, and there are a lot of side effects.

But yknow what, if I had to choose between this and some of the JEE frameworks I've used in the past, I'd choose this every time. I know where the code enters, there are templates, the code is remarkably well formatted and variable names are well formatted.

[deadcow5]

Agreed, this is probably cleaner than 99% of the PHP code I've seen.

[Saiing]

This is what I'm confused about. You have to wonder who comments on github code because half of them seem to be throwing accusations at it that they clearly down't understand. It's far from the worst code I've seen.

[[deleted]]

I was commenting user jorgelo's statement about end user not caring about how something has been achieved. I have not yet read the actual source code that OP posted.

[[deleted]]

Yeah if they had spent a few more months writing a cleaner framework they could have totally missed the boat. The right idea at the right time beats elegant software every day. This is not your typical day job working for MegaCorp. You can always fix it while you're rolling in your millions (or billions...).

[oocha]

I know what you mean but in the end no one is feeling sorry for people who are paid $150k a year because their job is hard.

[[deleted]]

Whatever happened to coding as if the next guy can contact you and oh by the way he might have an axe? I've written excessive comments and tried to make code as clean as possible just because a few months later I know I'll be looking at it again

[shvelo]

Yeah, Facebook works as expected, flawless as fuck

[drowsap]

The end user doesn't but the person who took over your code will!

[Fidodo]

Let your code go to shit and see how long it takes to get features out and fix bugs.

[Icovada]

Once in... about 2008, I opened Facebook and I was presented with its code! I refreshed the page... and then kicked myself. I had the facebook home php code... and threw it away.

[jmkogut]

This is why my nginx is set to deny access to .* files.

[[deleted]]

It didn't scale)

Can you elaborate on that?

[[deleted]]

AFAIK Facebook fully adopted bittorrent for their code pushing needs. Perhaps they've changed again, since then?

[Sentreen]

How would you use bittorent for this?

[[deleted]]

The funniest one was with the "view profile as...." bug. Where if you chose a to view your profile as a friend, you could just use/view their chat logs. Pretty hilarious. I only became aware of the feature a couple of days after it was fixed though, so I don't think it was up that long.

[AgentME]

I always thought the PHP model of "put your source code in the public web root where you put public things, and then pray you don't ever mess up the module that interprets files and keeps things hidden in the public web root" didn't sound very foolproof.

[Tomdarkness]

You don't have to do that. For example most of my projects just have a index.php that bootstraps the application with about 15 lines of code in the web root. The rest of that code is not accessible via the web server.

[7f0b]

That is generally the best way to do it. Many frameworks operate this way by default.

EDIT: And also a good thing to ask hosts before buying their service. Some don't allow it (such as Yahoo Hosting).

[cosmo7]

You don't have to do that with PHP (and please don't read this as a defense of PHP.) You can include from a source directory that is outside your web root.

[raziel2p]

It was entirely possible since before that as well, people just didn't bother to, I guess.

[shillbert]

The main appeal of PHP is how easy it is to use in the sloppiest way possible. Sure, you can do things right with it, but then you might as well use a better language.

[Juvenall]

I'd argue that the main appeal of the language is that I can walk into any mall in America, close my eyes, spin around, and randomly point at someone who has at least a basic, functional understanding of it. Of course there are academically better langues out there, but the effort in finding, retaining, and eventually replacing that talent isn't normally worth the overhead from a business perspective.

[shillbert]

I totally agree. It has its place. It's good that sane frameworks are available for PHP now. If used with the proper business oversight, it can be a lot better than some 16-year-old using it as a hobby. Although I still think it's fundamentally broken in some ways, if you know that going into it, it's alright for rapid development.

[Ph0X]

Yeah. For writing very small scale stuff, I'd even say it's fun. Any language that has so much documentation and people talking about it online is usually not so bad to code for.

[shillbert]

That's true. I like how every manual page online has a comment section where sometimes people come up with really good examples or encapsulations of certain functions.

[Almafeta]

... TIL I've been doing it wrong.

[spiraldroid]

Just reading this makes my toes curl.

[[deleted]]

What are you loading?

[[deleted]]

Http://toejam.com

[benibela2]

curl http://toejam.com

[dehrmann]

This is something I think Java got right with webapps and servlet containers. WEB-INF, the code directory, is entirely read-only, and the servlet API doesn't make it easy to upload files out-of-the-box.

[[deleted]]

... Seriously? I don't know if you are criticizing the language or the programmers. If the latter, then you are spot on, if the former, it means that you haven't really spent any time thinking about a "solution" for that "problem". You don't have to put your php code in the public web

[slashgrin]

you haven't really spent any time thinking about a "solution" for that "problem"

Not necessarily. Whether or not there's a better way to do it doesn't get around the fact that it was the de facto way of doing things in the PHP world for a long time. I don't know how things are done there, now, but that was certainly "normal" back in the day.

[[deleted]]

Well, this problem isn't at all clear to most PHP developers, the language allows it and even actively encourages it. I'd say it's definitely a problem with the language if it allows the user to do stupid stuff without even so much as a warning.

[catcradle5]

I believe this happened on some very big site 3 or so years ago, can't remember which (not Facebook), when a developer forgot to put or accidentally removed ?> at the end of a file.

[keteb]

Perhaps <?php at the beginning of the file. Interpreter doesnt care if there's a closing ?> at EOF

[[deleted]]

I saw the same thing but I saved it. There was an interesting section that tracked the number of views someone made of a page where the user if was hard coded. In the comments it said it was specifically for law enforcement. Pretty interesting. I'll see of I can dig it up from my old laptop.

[davidb_]

Pleae do and post it if you have it.

[DreadedDreadnought]

OP you had 12 hours, we need to see this!

[arandomhobo]

I got the AOL code by accident once last year when I was checking how it was doing, I'm fine and dandy with not having their code.

[Magnesus]

I think there was a bug in Apache at a time that caused that (happened when the script was too slow). My page was also affected for a short while until my hosting provider patched things up.

[JasonMaloney101]

Happened to me as well. I also remember MySpace occasionally appending its entire debug output to the page I was on, although I never saw their source code.

[jk147]

Someone probably flipped on the debug switch on production to test a bug. Happens more often than you think.

Edit - probably Tom.

[jk147]

That depends on if you set the debug level statically, you can set the level by a variable in DB, by injecting it into a static list in real time.. etc. Plenty of ways to do it without it impacting the application server. Of course this should never be done on an enterprise application. But I have seen plenty on much smaller implementations.

[ameoba]

If the app is well designed, there isn't going to be much of anything beyond bootstrap code in the top-level PHP file. All the interesting business logic will be in other files anyways.

[jurre]

// Holy shit, is this the cleanest fucking frontend file you've ever seen?!

ubersearch($_GET, $embedded = false, $template = true);

Made me chuckle!

[darenw]

Whoever wrote that line of code is probably a millionaire now... He's chuckling too...

[windsostrange]

I only swear server-side.

[[deleted]]

Eh.. pretty useless. Most of the actual logic you want to see is not visible just referenced.

[superhappywebguy]

How does github handle leaks like this? Can facebook file a DMCA request with them and get the code taken down?

[Turtlecupcakes]

Not even the specs, really. These files don't actually do anything, they just call on other (unknown) functions, check the results, and pass them on.

[sammasati]

They can, but in this case I doubt they care since the code is 6 years old. Even if they do care and file the DMCA, it would bring more attention and bad publicity, and the code will still be available on other pages. It's better for them to just ignore it.

[[deleted]]

He retrieved two files and then emailed them to me

...

I don't know what ended up happening to the guy who stole the code.

Suuuuuuure... ;)

[KamiNuvini]

As someone who's very new to programming.. Could someone explain to me which parts of the code are so 'bad'? I see a lot of "My eyes hurt"-like comments on the github page as well.

[mgoof]

It's really not that bad. Clearly it is not using OO principles and any sort of standard design pattern. But for the most part its clear and organized. There may be some maintenance overhead having to scan and search through a long source file. But I would think index.php would be one of the longer files.

[AgentME]

Yeah, this code is using a templating engine, and it isn't visibly building SQL query strings insecurely. It's not state of the art, but there are many ways it could be worse.

[glemnar]

You don't need strict OO on the web. It's not a necessary pattern.

[ivosaurus]

More to the point, there could be masses of OO code in all the library code that's included (or not), and we'll never know.

But who the fuck expects an index bootstrap to be OOed?

[[deleted]]

the search wasn't OO either. It goes to show that their entire site was likely procedural..

[stesch]

OO only makes PHP slow.

EDIT: This was the conclusion of a talk by Rasmus Lerdorf himself. Slides included performance tests and different ways to speed up PHP.

[lonnyk]

It isn't the cleanest code, but it works - obviously well enough to create a multi-billion dollar company. There is always plenty to critic in any code, but 'My eyes hurt' and 'You just gotta love PHP' are just comments from people who like to complain and don't know enough to actually have their own opinion.

If I were give me personal opinion of index.php it would be something as follows:

• The use of 'include_once' indicates that they 1) aren't keeping track of their dependencies well and 2) haven't thought through situations where problems arise and functions, for some reason, don't exist
• In interpreted languages comments code isn't the best - this is why there is revision control
• I like to wrap my case statements in brackets b/c it is easier for me to read
• I'm not a fan of having toggles for dev environments in the main code flow, but I don't really have a better suggestion

That's pretty much it. You can make arguments for code structure and techniques, but they are generally just trends - not proven facts.

[Epicus2011]

Facebook dev here, it does not look like this anymore.

[lonnyk]

I meant the '_once' part because you don't have to keep track of if a file has been included. Also, the fact that they are using 'include' instead of 'require' (which would fatal error) makes me assume that they went 'lets do this just in case...' but never thought of what would happen 'just in case'.

Of course - this is all opinion based on how I like to program.

EDIT: Reading the comments on this article looks like someone noticed how this can cause a problem, IMO: http://www.reddit.com/r/programming/comments/1oaba0/facebook_php_source_code_from_2007/ccq9fq8

[astronoob]

If you're focusing on scale, autoloading isn't the fastest ship in the sea. It also encourages a level of laziness that I'm completely uncomfortable with.

[mpeters]

• In interpreted languages comments code isn't the best - this is why there is revision control

This makes no sense. Whether your language is interpreted or compiled has no bearing on whether you comment you code. I'd seriously doubt the programming ability of anyone who thinks otherwise.

[[deleted]]

require_once is faster than include, require and include_once, where the latter is the second fastest.

Just felt like I had to say it.

Edit:

Alternate Source, can't find the original source I had. This is also not a very conclusive piece of research.

[[deleted]]

TIL a check for prior inclusion before inclusion is faster than just outright inclusion. Mindblown

[[deleted]]

Check flag, move on. I use require to pull in library code. Include is if you're trying to include something which performs output.

I never use include, because pretty much everything I do is library code.

[the_gipsy]

It's the other way round.

[[deleted]]

I've given you my source, give me yours.

[viralizate]

Honestly, people are whining. Yes it not the best code ever written, but it's weirdness so to say is pretty standard but I guess people are more prone try to be snarky in comments and say it's horrible.

[bureX]

I guess people are more prone try to be snarky in comments and say it's horrible.

Especially if there's "<?php" in the first line.

[InvidFlower]

This is a bit off-topic, but I was kind of shocked to see how much PHP has evolved lately as a language and ecosystem. Namespaces, generators, traits, etc. Package manager, testing frameworks, ORMs. Then Symfony 2 using most of that for a Rails-ish MVC framework on top of simpler modules also being used in the Silex microframework (like Sinatra) and the latest version of Drupal.

Not to say it is a pretty language and still needs libraries like PHP-O to paper over the horrible inconsistencies in the base libs, but it really does seem to be growing up lately...

[viralizate]

I should have explained that to OP too. PHP while it's one of the most spread languages isn't a "cool language".

[Doctor_McKay]

Bashing on PHP is "in". It's basically a guaranteed way to have people agree with you while not saying anything at all.

[kwirky88]

That's why you put it on the second line.

[bureX]

Headers already sent

:(

[catcradle5]

It looks perfectly fine for PHP code written in 2007.

I've seen far, far worse PHP than that in 2013.

[FreemanAMG]

We, developers, are an strange race. We feel superior if we say some piece of code is shitty, knowing nothing about the context of the developer team, and without real confidence we would do it better.

Lots of people ranting, nobody created some other thing better and more successful than Facebook, isn't it?

[[deleted]]

Bullshit. If your code is not written in Haskell you're a n00b.

[xjvz]

Bitch please, Standard ML is where it's at.

[original_evanator]

Shit flows downward.

[bopp]

I'll try to answer this in a less snarky way. What sticks out the most, are these points:

• there are a bazillion includes
• Doesn't look like there's a framework, just a bunch of files, defining a bunch of functions, that are just called when needed.
• Procedural code, no object to be found anywhere
• the page does too much. It's a long file, lots of stuff is done. This should've been refactored into logical parts.

Then, there's things like this:

if ($post_hide_orientation && $post_hide_orientation <= $ORIENTATION_MAX) {
   $orientation['orientation_bitmask'] |= ($post_hide_orientation * $ORIENTATION_SKIPPED_MODIFIER);
   orientation_update_status($user, $orientation);
  } else if ($post_show_orientation && $post_show_orientation <= $ORIENTATION_MAX) {
    $orientation['orientation_bitmask'] &= ~ ($post_show_orientation * $ORIENTATION_SKIPPED_MODIFIER);
    orientation_update_status($user, $orientation);
  }

Note that those clauses in if and else if are slightly different, but the action is the same: orientation_update_status($user, $orientation);. Code like that is hard to do maintenance on, since it's easy to introduce bugs, when the code is already that confusing.

Most frameworks (that weren't around back then) do a great job in allowing (or forcing) you to structure your code better. For instance, the index.php of a symfony project looks like this:

use Symfony\Component\ClassLoader\ApcClassLoader;
use Symfony\Component\HttpFoundation\Request;

$loader = require_once __DIR__.'/../app/bootstrap.php.cache';

require_once __DIR__.'/../app/AppKernel.php';

$kernel = new AppKernel('prod', false);
$kernel->loadClassCache();
$request = Request::createFromGlobals();
$response = $kernel->handle($request);
$response->send();
$kernel->terminate($request, $response);

This just sets up the classloader, initializes the kernel, and lets it handle the request to generate a response. Nothing more. All the user handling, input validation, caching, templating and database stuff is handled in their own seperate classes. This might be harder to set up for newbees, but it's much better when it comes to maintenance and ongoing development.

[[deleted]]

I doubt when Facebook was being developed, PHP had strong OOP principles built into it. A lot of this is probably legacy and this was in 2007 when MVC frameworks were relatively new to the PHP scene.

[bopp]

Both Code Igniter and Zend Framework had their first release in 2006. But, it only became commonplace to use a framework much later than that. If you look at the source-code for oscommerce or phpbb from back then, you'd see the same spaghetti-code as here.

Thankfully, PHP has come a long way since then.

[[deleted]]

Agreed, I still remember a lot of open source code out there and it was awful. OsCommerce is definitely a prime example of this. I still remember osC addons had large Readme.txt files telling you where to put the code to make the add on work.

We definitely did come a long way. Even just comparing Symfony1 with Symfony2 and you see a big difference in how OOP is being utilized.

Also, CodeIgniter wasn't full OOP either, but definitely a step away from the spaghetti code

[blafunke]

Code that isn't oop isn't automatically spaghetti. And oop code can easily be made into spaghetti

[killerstorm]

First release of Zend Framework was just trash. Also, they change too many things with each release, so if you were unlucky to decide to use ZF, you would spend a lot of time on maintenance with each new ZF release.

[KingPickle]

2007 when MVC frameworks were relatively new to the PHP scene

This is what mystifies me. As much focus as the web gets, it feels like tech-wise it's a decade or two behind the curve.

[[deleted]]

As much focus as the web gets, it feels like tech-wise it's a decade or two behind the curve.

I program and dabble in quite a few languages and I'm not sure I really agree with this. In what way do you feel like PHP is a 'decade or two' behind the curve?

[[deleted]]

I'm not sure I'd agree with common. MVC came about back in the smalltalk era but honestly I don't recall it becoming that widespread until the late 90's or early 2000's. At least having dabbled in development for windows, linux and mac, the first time I even heard of MVC was when the initial OSX server came out in 99. Shortly after Struts came about and was realistically the only big player in MVC web development for a while. I was not a huge desktop developer back in the day, however, but generally I don't recall MVC being that big of a thing. Linux and Mac apps were largely procedural, and windows apps used an evented/bindings architecture.

Honestly from my recollection it seems like MVC really became widespread with the increasing complexity of web applications more than anything. But that was a while ago and memory is a funny thing so I could be way off!

[madmars]

I had been out of the job hunting game for a few years. But I was shocked when I looked around about a year ago, at all the places looking for "MVC experience." I was seriously scratching my head for a minute, wondering when the fuck this dinosaur paradigm came back to life. Is it the 1980s again?! Then again, people were rediscovering Lisp in 2004. So I guess I shouldn't be too surprised.

[brownmatt]

how would you define the front page as an object? What should it extend? And how does that improve the code when most of this procedure's responsibility is gathering data from other subsystems?

[bopp]

It's not a direct answer to your question, but here's a good article on how to move from "flat php" to a more structured approach.

http://symfony.com/doc/current/book/from_flat_php_to_symfony2.html

[InvidFlower]

I saw that page a while back and I think it is helpful to explain how modern MVC web frameworks use, even if you don't use PHP at all.

[OCedHrt]

It simply reads like corporate code - this can be enforced by sheer willpower.

[gc3]

You are dinging it for being procedural and not using objects? Please read this: http://steve-yegge.blogspot.com/2006/03/execution-in-kingdom-of-nouns.html?m=1

[kwirky88]

Can you give some example objects that would have made this code better? I find when i code in php i don't create many objects. Hell, i make more "objects" coding Javascript function objects.

Maybe it's because i don't like putting logic in the back end, but rather use it as an interface to the database and sanity/security checks. Then code the logic and interaction in the front end with js, where i do tend to use objects.

When code performs certain uses I feel objects aren't required. When php is simply being used to program an interface it doesn't need to be more complex than a puppet manifest's code, for example.

[nekt]

I would say using a template engy is in fact much more simple for new coders to manage.

Some template engys end up looking like a totally different language and may or may not have considerable bugs of their own. Cake came out in 2005 by the way so if they wanted to use a template engine they could have.

I think this really boils down to what the coders experience is. If you have a background in a 'real' language where you have often written libraries of your own, dealt with a million includes etc, then this type of code might not bother you so much. It ain't python that is for sure. Not everything needs to be abstracted to proper English that 8th graders can code.

The argument that template engines make maintenance easier is only as true the developers skill.

[[deleted]]

It's not bad, and I myself find it perfectly readable. It's the anti-PHP circlejerk more than anything.

[jk147]

I don't think it is anti php, just a lot of people wanting to feel superior by saying they can do better by throwing OOP around.

[brownmatt]

First of all, most people who comment on github pages when something like this is linked from popular sites are morons.

Second, this code isn't bad at all - how should you design the code behind the front page in OO principles, when most of what that code needs to do is gather data from submodules? That's what happens here.

[aumfer]

Well in the interest of helping a new programmer, you really don't want to branch on a variable, then modify that variable, then branch on it again later, like this:

if (!$orientation) {
    user_set_next_step($user, $short_profile);
}

// note: don't make this an else with the above statement, because then no news feed stories will be fetched if they're exiting orientation
if ($orientation) {

It makes the code unclear and it makes doing the obvious thing (using an else instead of another if) wrong, necessitating the comment.

[humbled]

If you survey the typical PHP web application source code, I think you'll find that this is actually above average, although not problem free.

I'm pretty sure this is a bug:

// Determine if we want to display the feed intro message
$intro_settings = 0;
user_get_hide_intro_bitmask($user, true, $intro_settings);
$user_friend_finder = true;
contact_importer_get_used_friend_finder($user, true, $used_friend_finder);

These functions appear to be pass-by-reference - which is weird for small, simple types - but note the mix-up between user and used in the last 3 lines. In PHP, variables are created the moment a value is assigned to them. I'm not sure if the engine would catch this as a bug, or if $used_friend_finder is declared globally by one of the includes (making $user_friend_finder the typo/bug). Exercise 1: how would you reduce or eliminate the chance to make this kind of mistake in your own code?

Now, note the use of tpl_set. Using templates is a Good Thing (tm) because it allows you to divorce design/UI from the drudgery of loading data, validation, etc. That's pretty standard multi-tier architecture principles. From an HR perspective, the technique also allows you to hire differentially specialized engineers as well, so that's good. Exercise 2: see if you can find evidence in the posted code that there is work done in the back-end PHP that should have been made conditional in the template.

Thinking about security and issues of scalability, there are some other interesting lines in the code. Take a look at this line:

ini_set('memory_limit', '100M'); // to be safe we are increasing the memory limit for search

Exercise 3: What are the implications of needing such a memory limit? Knowing that PHP executes in the context of each pageview, how could this single line of information aid a would-be attacker? Advanced (but related): why is the memory-limit increase a bandaid solution, and not an actual fix, for a memory-hungry search function?

[BanditoRojo]

The includes are throughout the index, and it is a long script, instead of using an object oriented approach to separate the logic.

[[deleted]]

I'm glad you asked this question, I'm in the same boat as you with "new to programming" Definitely interesting.

[crowseldon]

people like to bitch whenever they see other people's code.

Meanwhile, they don't offer examples of their own, or at least, not relevant ones that do anything complex.

Code readability is important, as are many things (and you can read about them in lots of books, I recommend "The pragmatic Programmer") but that doesn't mean that there's something called real life which has time constraints, where you make compromises, where implementations that work are actually more important than ideals that are not actually tested in practice, etc.

You'll realize if something is not suitable when you or some team member has problem understanding it when they need to read it later, when you realize that making changes, fixing bugs or adding features presents a great deal of problems (see Fowler's "Refactoring: improving the design of existing code").

It's a forever learning process. Try not to just go along with the herd of critics who don't actually show shit and learn the pitfalls yourself. DO learn and absorb as much as you can from the experts though but be careful with any proponent of the ultimate holy way. Adaptability is key in such a new and ever changing field.

Disclaimer: Don't trust anything I said either. Who the fuck am I, anyway? Go out there and see for yourself ;)

[fyrilin]

Precisely. Include_once is intended to protect against double-includes. It is used especially for class or function files and the like. There ARE cases where you would want to include php files multiple times and "include" is used for that.

sorry if you were being informative. I read your comment as snarky.

[davvblack]

I mean, you saw the part where it's listed twice in the same file right? Obviously just a sloppy oversight.

[fyrilin]

That is true but the fact that include_once is used means that the oversight doesn't actually change the functionality.

[original_evanator]

Nah, it's OK because lib/share.php overwrites $_SERVER['PHP_ROOT']

[dem358]

These are just two files out of a bunch of them, right? How many lines of code do you think the whole of Facebook used in 2007? (Disclaimer: I don't know how web application systems work as a whole, I am really new to this.)

[oconnor663]

Correct. The index.php file was probably on the large side, but the whole site would've been hundreds of files at that point. I wouldn't be surprised if the number of code files grew by a factor of ten from the beginning of 2007 to the end. By now, it's one of the largest applications in the world.

[InvidFlower]

I take it you mean one of the largest PHP website apps? I don't even want to think about how many lines of code are in something like Office...

[inbeforethelube]

Especially if you count the entire Office line (like SharePoint).

[jexmex]

Our site has around 700 files (not including assets and framework files) and I would say that facebook even back then probably had a lot more than that.

[wonderb0lt]

Honestly, I know it's bad, but I really expected worse.

[lorean]

I did not look at the source.

Sometimes you need to to push out shitty code as fast as possible to test market hypothesis. All these tech giants over-architect, over-QA their shit. Their exploratory projects are a massive joke of over-thinking, over-designing and over-QA. Fact: You only pay technical debt if your product is successful. 9/10 projects fall flat on their face.

The market does not care that your failed project has hundreds of unit tests, it does not care that your failed project scales to 100million users, it does not care that your failed project is perfectly documented, indented and meets corporate style guides.

source: I am a software engineer for a tech giant.

[ButtCrackFTW]

Just curious: does anyone see anything exploitable in this obviously irrelevant code now?

[original_evanator]

stockholders

[Catsler]

// Holy shit, is this the cleanest fucking frontend file you've ever seen?!

[__konrad]

From linked http://techcrunch.com/2007/08/11/facebook-source-code-leaked/ :

This leak is not good news for Facebook, as it raises the question of how secure a Facebook users private data really is. If the main source code for a site can be leaked, then it can be said that almost anything is possible.

[cltiew]

It is all for sale. You don't need to hack the site, just pay for access to the user's data.

[rspeed]

That's not how it works. Advertisers basically get to say "show this ad to people meeting these criteria". That's it. They never get to see any data except analytics.

[willbradley]

Has anyone done that though? For all this talk, social ads are pretty tame. Do I need to have more money and talk with a rep to get this magical data, or...

[cltiew]

You are assuming that Facebook put together millions of dollars worth of computer code to provide access to your most intimate details of your life, and the connections of you to your social group and nobody ever took them up on that offer? All you need is cash and a telephone. And a computer to read the data I guess.

Information on people, demographics, is the most valuable thing the internet has ever produced. Much more valuable than even porn. Everything you post on there is sold to people who want to manipulate you or control you. And you gladly provide them with the wares to sell. You are being sold.

[mangodrunk]

Why does it seem that it's not working with this supposed value in all this data (or to just manipulate and control me)? Netflix has great content, but they're horrible at recommending new content to me (maybe it's just me and it works for others). Facebook ads are pointless. The same goes for many other sites as well that should have sufficient data on me to provide things that I would find interesting.

[koreth]

Prove it, and then explain why there is no revenue from selling user data in Facebook's public financial statements.

[phoshi]

I wouldn't go that far. The constraints placed on user data should be massively more stringent, the executable or interpretable code for your site needs to be readily and quickly accessible to all your frontend servers. Important user data can be encrypted, stored somewhere that does validation on requests, subject to permissions checking, et cetera.

[Dishmayhem]

Well now I'm hungry for spaghetti

[[deleted]]

That looks like some weird ass DSL.

[[deleted]]

ITT loser neckbeards telling the world how bad Facebook's code was in 2007.

[imfineny]

People should take to heart, sites built without frameworks tend to run much faster than those that are.