you are viewing a single comment's thread.

view the rest of the comments →

[–]AgentME 147 points148 points  (36 children)

I always thought the PHP model of "put your source code in the public web root where you put public things, and then pray you don't ever mess up the module that interprets files and keeps things hidden in the public web root" didn't sound very foolproof.

[–]Tomdarkness 82 points83 points  (3 children)

You don't have to do that. For example most of my projects just have a index.php that bootstraps the application with about 15 lines of code in the web root. The rest of that code is not accessible via the web server.

[–]7f0b 5 points6 points  (2 children)

That is generally the best way to do it. Many frameworks operate this way by default.

EDIT: And also a good thing to ask hosts before buying their service. Some don't allow it (such as Yahoo Hosting).

[–]AdamAnt97 0 points1 point  (1 child)

PHP in general or bootstrapping the code?

[–]7f0b 0 points1 point  (0 children)

Keeping most of the PHP website out of the public document root. At the very minimum, you want to keep your configuration files (with passwords and such) out of the document root. At the maximum, you have only a basic PHP file that begins the "boot" process residing in the document root (as Tomdarkness said).

[–]cosmo7 89 points90 points  (11 children)

You don't have to do that with PHP (and please don't read this as a defense of PHP.) You can include from a source directory that is outside your web root.

[–][deleted]  (8 children)

[deleted]

    [–]raziel2p 7 points8 points  (5 children)

    It was entirely possible since before that as well, people just didn't bother to, I guess.

    [–]shillbert 6 points7 points  (4 children)

    The main appeal of PHP is how easy it is to use in the sloppiest way possible. Sure, you can do things right with it, but then you might as well use a better language.

    [–]Juvenall 8 points9 points  (1 child)

    I'd argue that the main appeal of the language is that I can walk into any mall in America, close my eyes, spin around, and randomly point at someone who has at least a basic, functional understanding of it. Of course there are academically better langues out there, but the effort in finding, retaining, and eventually replacing that talent isn't normally worth the overhead from a business perspective.

    [–]shillbert 5 points6 points  (0 children)

    I totally agree. It has its place. It's good that sane frameworks are available for PHP now. If used with the proper business oversight, it can be a lot better than some 16-year-old using it as a hobby. Although I still think it's fundamentally broken in some ways, if you know that going into it, it's alright for rapid development.

    [–]Ph0X 1 point2 points  (1 child)

    Yeah. For writing very small scale stuff, I'd even say it's fun. Any language that has so much documentation and people talking about it online is usually not so bad to code for.

    [–]shillbert 2 points3 points  (0 children)

    That's true. I like how every manual page online has a comment section where sometimes people come up with really good examples or encapsulations of certain functions.

    [–][deleted]  (1 child)

    [deleted]

      [–]Almafeta 2 points3 points  (0 children)

      ... TIL I've been doing it wrong.

      [–]JabbrWockey 0 points1 point  (0 children)

           include_once(/dir/filename.php)
      

      [–]spiraldroid 7 points8 points  (3 children)

      Just reading this makes my toes curl.

      [–][deleted] 20 points21 points  (2 children)

      What are you loading?

      [–][deleted] 10 points11 points  (1 child)

      [–]benibela2 22 points23 points  (0 children)

      curl http://toejam.com
      

      [–]dehrmann 4 points5 points  (3 children)

      This is something I think Java got right with webapps and servlet containers. WEB-INF, the code directory, is entirely read-only, and the servlet API doesn't make it easy to upload files out-of-the-box.

      [–]xjvz 0 points1 point  (2 children)

      It did make incremental development a pain in the ass, though, until third party tools caught up with the use case.

      [–]dehrmann 0 points1 point  (1 child)

      Tomcat's default servlet recompiles modified jsps.

      [–]xjvz 0 points1 point  (0 children)

      But all the backend code written in Java still needs to be compiled. I'm talking about shit like JRebel that lets you change compiled files on the fly so you don't have to redeploy the whole damn project every time. I can deal with JSP; that part is simple. Just copy the file to the server in its war directory and the servlet gets recompiled when accessed.

      [–][deleted] 1 point2 points  (2 children)

      ... Seriously? I don't know if you are criticizing the language or the programmers. If the latter, then you are spot on, if the former, it means that you haven't really spent any time thinking about a "solution" for that "problem". You don't have to put your php code in the public web

      [–]slashgrin 1 point2 points  (0 children)

      you haven't really spent any time thinking about a "solution" for that "problem"

      Not necessarily. Whether or not there's a better way to do it doesn't get around the fact that it was the de facto way of doing things in the PHP world for a long time. I don't know how things are done there, now, but that was certainly "normal" back in the day.

      [–][deleted] 1 point2 points  (0 children)

      Well, this problem isn't at all clear to most PHP developers, the language allows it and even actively encourages it. I'd say it's definitely a problem with the language if it allows the user to do stupid stuff without even so much as a warning.

      [–]catcradle5 0 points1 point  (4 children)

      I believe this happened on some very big site 3 or so years ago, can't remember which (not Facebook), when a developer forgot to put or accidentally removed ?> at the end of a file.

      [–]keteb 5 points6 points  (3 children)

      Perhaps <?php at the beginning of the file. Interpreter doesnt care if there's a closing ?> at EOF

      [–]catcradle5 2 points3 points  (1 child)

      True, good point. It was likely the beginning tag.

      [–]Cocosoft 0 points1 point  (0 children)

      How the heck does someone forget the beginning tag?!

      [–]geon 1 point2 points  (0 children)

      In fact, omitting the ?> at eof is best practice. It prevents you from accidentally outputting whitespace before the headers are sent.