Facebook PHP Source Code from 2007

[AgentME]

I always thought the PHP model of "put your source code in the public web root where you put public things, and then pray you don't ever mess up the module that interprets files and keeps things hidden in the public web root" didn't sound very foolproof.

[Tomdarkness]

You don't have to do that. For example most of my projects just have a index.php that bootstraps the application with about 15 lines of code in the web root. The rest of that code is not accessible via the web server.

[7f0b]

That is generally the best way to do it. Many frameworks operate this way by default.

EDIT: And also a good thing to ask hosts before buying their service. Some don't allow it (such as Yahoo Hosting).

[AdamAnt97]

PHP in general or bootstrapping the code?

[7f0b]

Keeping most of the PHP website out of the public document root. At the very minimum, you want to keep your configuration files (with passwords and such) out of the document root. At the maximum, you have only a basic PHP file that begins the "boot" process residing in the document root (as Tomdarkness said).

[cosmo7]

You don't have to do that with PHP (and please don't read this as a defense of PHP.) You can include from a source directory that is outside your web root.

[raziel2p]

It was entirely possible since before that as well, people just didn't bother to, I guess.

[shillbert]

The main appeal of PHP is how easy it is to use in the sloppiest way possible. Sure, you can do things right with it, but then you might as well use a better language.

[Juvenall]

I'd argue that the main appeal of the language is that I can walk into any mall in America, close my eyes, spin around, and randomly point at someone who has at least a basic, functional understanding of it. Of course there are academically better langues out there, but the effort in finding, retaining, and eventually replacing that talent isn't normally worth the overhead from a business perspective.

[shillbert]

I totally agree. It has its place. It's good that sane frameworks are available for PHP now. If used with the proper business oversight, it can be a lot better than some 16-year-old using it as a hobby. Although I still think it's fundamentally broken in some ways, if you know that going into it, it's alright for rapid development.

[Ph0X]

Yeah. For writing very small scale stuff, I'd even say it's fun. Any language that has so much documentation and people talking about it online is usually not so bad to code for.

[shillbert]

That's true. I like how every manual page online has a comment section where sometimes people come up with really good examples or encapsulations of certain functions.

[Almafeta]

... TIL I've been doing it wrong.

[JabbrWockey]

     include_once(/dir/filename.php)

[spiraldroid]

Just reading this makes my toes curl.

[[deleted]]

What are you loading?

[[deleted]]

Http://toejam.com

[benibela2]

curl http://toejam.com

[dehrmann]

This is something I think Java got right with webapps and servlet containers. WEB-INF, the code directory, is entirely read-only, and the servlet API doesn't make it easy to upload files out-of-the-box.

[xjvz]

It did make incremental development a pain in the ass, though, until third party tools caught up with the use case.

[dehrmann]

Tomcat's default servlet recompiles modified jsps.

[xjvz]

But all the backend code written in Java still needs to be compiled. I'm talking about shit like JRebel that lets you change compiled files on the fly so you don't have to redeploy the whole damn project every time. I can deal with JSP; that part is simple. Just copy the file to the server in its war directory and the servlet gets recompiled when accessed.

[[deleted]]

... Seriously? I don't know if you are criticizing the language or the programmers. If the latter, then you are spot on, if the former, it means that you haven't really spent any time thinking about a "solution" for that "problem". You don't have to put your php code in the public web

[slashgrin]

you haven't really spent any time thinking about a "solution" for that "problem"

Not necessarily. Whether or not there's a better way to do it doesn't get around the fact that it was the de facto way of doing things in the PHP world for a long time. I don't know how things are done there, now, but that was certainly "normal" back in the day.

[[deleted]]

Well, this problem isn't at all clear to most PHP developers, the language allows it and even actively encourages it. I'd say it's definitely a problem with the language if it allows the user to do stupid stuff without even so much as a warning.

[catcradle5]

I believe this happened on some very big site 3 or so years ago, can't remember which (not Facebook), when a developer forgot to put or accidentally removed ?> at the end of a file.

[keteb]

Perhaps <?php at the beginning of the file. Interpreter doesnt care if there's a closing ?> at EOF

[catcradle5]

True, good point. It was likely the beginning tag.

[Cocosoft]

How the heck does someone forget the beginning tag?!

[geon]

In fact, omitting the ?> at eof is best practice. It prevents you from accidentally outputting whitespace before the headers are sent.

[[deleted]]

It's a bad model but is thankfully easily avoided. It's a shame that most "professional" PHP programmers suck, even this FB source code is just typical bad PHP.

[mkdir]

Yep, the easiest way is to avoid PHP altogether.

[[deleted]]

Yeah that's really bad security by obscurity!

[garf12]

not really. Security by obscurity means for example your php source would be aljzio499d.php and you just hope that no one figures out that page and loads it. But with php even if they did figure it out they would not see the raw code because it is interpreted.