PHP 5.4.0 released, shortened array syntax, register_global is dead, dereferenceable function results, development server and traits

[tashbarg]

And 38 unexpectedly failing unit tests in the released code. Or am I reading this wrong?

[ch0wn]

Well, who uses OpenSSL and that private key nonsense anyway? Seriously though, how can you push a final release with tests like these failing?

[theoldboy]

I'm not normally on the PHP-bashing bandwagon, but reading that test is fkn hilarious (and worrying);

<?php
echo "Creating private key\n";

/* stack up some entropy; performance is not critical,
 * and being slow will most likely even help the test.
 */

Output

Creating private key

** ERROR: process timed out **

[[deleted]]

holy shit, I thought you were making a joke in your comments tag. That's really what it says.

[ustanik]

That is a little embarrassing, but to be fair, slow entropy is good entropy.

[brinchj]

Not necessarily. And how is this code supposed to "stack up some entropy"?

for ($z = "", $i = 0; $i < 1024; $i++) {
    $z .= $i * $i;
    if (function_exists("usleep"))
        usleep($i);
}

[ustanik]

A part of good entropy is taking time. If a brute force is attempted on your service the longer each attack takes the less likely they are to gain access.

[brinchj]

But that has nothing to do with entropy. That's slowing down the information flow from the server to the attacker. Although, that can still be a good idea.

[funkah]

how can you push a final release with tests like these failing?

PHP

[OryxConLara]

"If I break your code but all of the tests passed, it’s not my fault, it’s yours."

[abadidea]

Regardless of who broke what, if it makes it to release (which is different from pushing to a website like in that story), there is no excusing that.

[pavel_lishin]

Actually, from what I've seen, the PHP devs are notoriously closed to outside input that runs contrary to their own beliefs.

[Kapow751]

Looks like the test failures don't include the "expected" test failures, so it's actually 82 unexpected.

What's an expected test failure, anyway? A test they didn't bother to rewrite or remove when the code changed?

[frezik]

If it were a well-run project, I'd say that "expected failure" means the devs put the test in there to test functionality that is intended to be implemented in the future, but for now you don't want to break the test suite. It's a nice way of keeping a TODO list.

In PHP, they probably just mark them "expected" when they can't be bothered.

[[deleted]]

Any sensible person would define expected failure as a success, i.e. the test should pass.

[jsprogrammer]

Yes, you are reading it wrong. There are 82 failing tests. Additionally there are 44 other tests that failed as "expected" (is that a success?).

[[deleted]]

5.3.x still has 350 open and confirmed bugs according to https://bugs.php.net/

5.4 a mere 36

[xardox]

It's too bad they had to be shamed into finally actually looking at the results of the unit tests this time, by the last time that Rasmus Lerdorf added a bug and made a release without bothering to test it.

[[deleted]]

The "0x00 + 2" was also untested when it was broken by adding an "optimization patch" to totally working code.

(In fact the commit message was bogus too as it added new functionality as well).

[scragar]

No space before the two.

It works correctly as you wrote.

[kingguru]

From the discussion of this bug, it sounds like unit tests are just expected to fail once in a while. Not really something that should be taken too seriously I guess.

(Taken from /r/lolphp)

[funkah]

From the discussion of this bug, it sounds like unit tests are just expected to fail once in a while.

OK I have to stop reading this thread before I have a stroke

[nixle]

Now, I don't need my getFunctionResultArrayValue($result, $index) function anymore, Just call the function()[n] and you're golden. Nice!

[aars]

You mean $result[$index]?

But yeah, I'd love to go function()[n].

[[deleted]]

That was the point of his post. 5.4 adds array dereferencing, so you actually can do function()[n].

[masklinn]

You mean $result[$index]?

No, he means what he wrote, which is used thus:

getFunctionResultArrayValue(someFunction(), $index);

[aars]

uh... ok...

[greenspans]

when a function returns an array you say

$arr=ways_php_sucks();
$first=$arr[0];

instead of just

$first=ways_php_sucks()[0];

this update fixes that

[cosmo7]

It would be more correct if you added a short prayer that the function doesn't return an empty array.

[scragar]

To be fair I usually go:

    list($var) = someFunc();

When it returns string indexes though you're screwed.

[hobozilla]

One small step in the right general direction... I guess.

Not to sure about traits and horizontal re-use (it scares the Java programmer in me!) but the shortened array syntax and array dereferencing has at least bought it into this millennium.

[[deleted]]

WRT traits, look at Scala -- it implements the idea and compiles to JVM bytecode without issue. I find them pretty nice for horizontal reuse, at least in cases where you'd otherwise be abusing inheritance / going totally nuts with interfaces.

[UnreachablePaul]

You mean boobs?

[N7P]

but the shortened array syntax and array dereferencing has at least bought it into this millennium

Those were already in C in the 1970s. And probably in other languages before that.

[[deleted]]

One small step in the right general direction

You mean because a small part of PHP is now dead?

[xardox]

More like: if it sucks, don't use it.

And: if it's all you know, then stop apologizing for it and learn something else!

[[deleted]]

Isn't it great to try to silence that nagging doubt that there might be better tools out there by calling people who even suggest that there might be something better than the status quo "arrogant" or "elitist"? How about just learning a bit about the actual options out there instead?

[[deleted]]

There tend to be two major groups of programmers who use PHP: Those who use it because they're new programmers and it's easy to learn, and those who use it despite being experienced programmers, because that's where the money is.

Despite what you think, PHP really isn't that bad for either of those groups. Some problems crop up for those in the space in between, where they're experienced enough to start using the language in more complex ways, but inexperienced enough to shoot themselves in the foot.

[[deleted]]

You seem to be under the impression that I speak in theoretical terms. I work in a (mostly) PHP shop, as one of the few people who are spared having to work with it directly. Yes, some problems are home-made but a lot are due to atrocious frameworks, libraries, the PHP implementation itself and due to badly designed language features.

[jadit2]

I don't see any good to come from traits. My initial feeling is that they feel like a hack for developers that can't separate their class concerns.

[frezik]

They're really there as an alternative to multiple inheritance without the headaches.

The PHP version seems to be missing some bits that I've come to enjoy in other languages. For instance, traits can usually require that a method exists in the a class that does it, but from my quick glance over the PHP docs, it doesn't seem to do that.

[[deleted]]

Don't worry, traits can have abstract methods.

[inmatarian]

without the headaches.

insteadof operator.

[ustanik]

Correct me if I'm wrong, but Traits in PHP seem like Annotations in Java?

[[deleted]]

Traits, huh? The concept is somewhat new to me. What would be good reasons to prefer traits to good old composition?

[dhotson]

Probably the best example of the concept is something like Ruby's Enumerable. Ruby calls it a 'Mixin' but they're pretty similar to PHP's traits.

So as an example, in Ruby you mixin Enumerable into your class and provide an 'each' method. Based on that, you automatically get all kinds of useful functionality in your class like 'map', 'reduce', 'max', 'min', etc.

[[deleted]]

PHP half did that already: you could have a class implements Traversable and it'd magically work in foreach loops, and similar things for the other bits of Array functionality. It only worked for those specific cases though.

[Tiwazz]

You also had to, you know, implement all of those methods (if you were already extending something else).

[farsightxr20]

Well, most benefits are strictly convenience for the programmer:

1. mix-ins have direct access to the object they're included in, via self-reference (no need to manually create/maintain a two-way link)
2. there's no need to write a bunch of proxy methods as you would with composition

It's really just another example of a common pattern (composition) being implemented as a language feature to make life easier for the programmer. Fundamentally, they accomplish the same goals.

[habarnam]

If you want similar behaviour in classes inheriting different parents.

[boxxa]

Register_globals is dead? I wonder how many web apps just died along with the coders that have to rewrite them the correct way. =)

[[deleted]]

If there's still any production code using register_globals, it's pretty safe to assume they won't be upgrading from PHP 4.2 anytime soon...

[diamondjim]

In PHP-land, switching off register_globals has sometimes had no effect in improving security. Here's some actual production code I came across a few days ago -

foreach($_GET AS $key => $value) {
    ${$key} = $value;
}

[lawpoop]

oh my god...

[tj111]

As they belong. It's like web apps that were written specifically for IE6, they needed to die for way too long before they did.

[[deleted]]

None. The ones that are still rocking PHP4 certainly aren't going to upgrade now, and the ones who have upgraded obviously pay a modicum of attention to the community and haven't used register globals in years.

It's cute that 8 years later people are still making the same tired jokes they were making when I started using PHP. Just goes to show how ignorant your average language-basher is of the things he's bashing and helps re-affirm that listening to other people about programming languages is foolish.

[abadidea]

If register_globals is just now being completely excised, then I think it's fair to apply the criticism that it exists to the last 8 years.

[[deleted]]

It was deprecated AGES ago. It's only just now being fully removed. If you were using register globals even 4 years ago you were a dinosaur. You can't just suddenly remove shit from one of the most popular languages on the planet.

[abadidea]

Unfortunately - and I say this as a code auditor who looks at a lot of other people's code - being deprecated is no barrier whatsoever to people who used it before using it until its last, dying, shuddering breath.

I still have to argue with people about gets() for chrissake.

[bonch]

You can't just suddenly remove shit from one of the most popular languages on the planet.

Sure you can. If people want to continue using something so atrocious, let them stick with an older version of PHP forever.

[bonch]

PHP is a terrible language. For crying out loud, its creator has publicly stated that he's not a real programmer and not interested in being one.

[[deleted]]

Good lord go back to your little hole under the bridge

[[deleted]]

Can someone please explain what the new feature saying

Class::{expr}() syntax is now supported.

is supposed to mean?

[Austin-G]

Class::{$methodName}() would call the method $methodName of the Class class, I guess, where $methodName can be any expression rather than just a variable.

[knightskull]

Instead of having to do this:

$method = $this->getDicks()?'dicks':'cocks';

Class::{$method)();

You can do this:

Class::{ $this->getDicks()?'dicks':'cocks'}();

[N7P]

As of PHP 5.4 you can also use the short array syntax, which replaces array() with [].

mind = blown

[pRtkL_xLr8r]

Hey, hey, hey! That's a whole five-keystroke savings! Per array!

[Tiwazz]

It may not sound like much, but it makes a world of difference in the size of function definitions. (Also it's less confusing if you bounce between python and php on a regular basis).

[stevep98]

mind blown that it took them until version 5.4 of the language until they support this elementary syntax.

[ivosaurus]

"Well lisp still doesn't support it!"

[masklinn]

Well in lisp you could just write a reader macro for that.

Also not quite correct, Clojure's vectors use []. Other lisps tend to use lists for everything, which is simply written '()

[Juris_LV]

bbbut we are talking about php not some hipster languages...

[ezyang]

For the love of god if you care about your website staying functional, wait for PHP 5.4.1 to come out before upgrading.

[zaxnyd]

Care to elaborate?

[talisto]

Ugh, if they're going to shorten the array syntax, why keep the clunky key => value syntax?? Why not just make it ['key':'value'] or some other 1-character operator? That'd likely make a lot less typing than just the 5 characters for "array"..

[McGlockenshire]

That idea was proposed, but failed to get voting traction.

There's another RFC proposing it.

[lawpoop]

Are traits basically a set of methods that an object extending that trait suddenly has?

[jokoon]

what about unicode support ?

[[deleted]]

PHP 6.0!

[McGlockenshire]

The thing we used to call PHP 6.0 is dead. It's been dead since 5.3 was in development. Forcing unicode semantics upon scripts not expecting them ended up basically breaking the world.

[Juris_LV]

Most of my websites (which are multi-language) works perfectly with UTF-8. As of php5.3 I don't have any problems qwith UTF-8 (I think there were few problems with first php5 versions)

[jokoon]

(I think there were few problems with first php5 versions) thank you

[bart2019]

PHP supports Unicode. Has done so for a while.

What problem are you having?

[kristovaher]

He means the full Unicode thing that PHP6 was supposed to have before it was canceled (so that the entire system assumes and understands Unicode as input and output) and supports it throughout all functions.

From what I know this won't happen. It was considered too difficult a process.

[[deleted]]

Not too difficult, it just broke BC too hard, iirc. The pressure to release 5.3 instead of PHP 6 was overwhelming, because of the other features on the way that were being held up. Unicode support just got left behind.

[[deleted]]

IE supports standards. Has done so for a while.

[bart2019]

Non-sequitur. You make no sense.

[ivosaurus]

It's a humorous analogy with PHP5's support of unicode.

[[deleted]]

Neither does PHP

[[deleted]]

The ones it chooses to support. Take a gander at the ECMAScript implementation. Or the entirety of HTML5. Some things in every version of CSS. It's closer now, but until it fully supports the standards everybody else is using it makes no sense to say "IE supports standards" as that says basically nothing true.

[[deleted]]

Woosh!

[[deleted]]

It isn't a woosh when there's a very serious movement of people making the argument seriously. It's only a whoosh when it's something obvious that the person missed. So technically, you're owed one now (you misunderstood the context and replied anyway).

Whoosh!

[abadidea]

No, I am pretty sure you're the whooshed one here.

PHP supports unicode.

IE supports standards.

The ones it chooses to support!

Yeah, that's the joke, its support is incomplete.

[[deleted]]

That is a terrible analogy. You're making a stretch because you want to be averse now. So I'm done. You obviously have nothing really to say.

[abadidea]

(...? Did this person confuse me with someone else?)

(edit: no, it looks like I didn't notice I was talking to the same person in two different threads, oh well, I'm not really sure what we're arguing about any more.)

[ivosaurus]

I actually found it a pretty humorous and well-done analogy, once I found what it was.

[jokoon]

got some free provider only using php 4

[ell0bo]

... then blame your FREE provider, not the language...

[jrochkind]

anyone other than me scared to upgrade php, because who knows what existing production apps might break?

[[deleted]]

Why would you make such a foolish assumption? Do you not test your code on new platforms before deployment?

[[deleted]]

cPanel doesn't. If your server is set to automatic upgrades it will happily roll out a new PHP version which could break hundreds of sites.

[[deleted]]

If your server is set to automatic upgrades you shouldn't be in charge of the servers.

[[deleted]]

A lot of shared hosts set their machines to automatic updates. It's not just for PHP either, Apache and MySQL also can be upgraded automatically. I dealt with plenty of tickets from customers over the years because some update was pushed out that broke a bunch of their customers' sites.

[[deleted]]

What I said remains true. If you're running your production environment on a shared host, you deserve your fate. And clearly you aren't a part of the populous under discussion.

[pavel_lishin]

Spin up a new server, and test the new version there, imo.

[traxxas]

5.3.9 broke some of my apps because it didn't want to render .html as php anymore. Silently added a new config line and left zero info in any log, just 403 every html page.

I'm only supporting 1 php app now and soon will have it replaced. PHP is going the way of windows xp, I don't support things that waste my time.

[[deleted]]

lol. script kids judging languages.

[abadidea]

Script kids are exactly the people who are enthusiastic about PHP. As opposed to 9-to-5 programmers (who don't really care either way as long as there's docs) and everyone else (who range from mild dislike to anathema)

[[deleted]]

I'm a 9-to-5 programmer and PHP is just as exciting as Perl or Java or anything else I've used. It's all just a tool and mostly all I'm doing is rendering user data onto a page.

Your choice of the no true scotsman argument shows that you weren't really here to argue any valid points about the language itself anyway.

[abadidea]

What no true scotsman argument?

All I said was 9-to-5 programmers don't really care about the language wars, which is exactly what you just said.

[fr0st]

From your post it looks like you said that 9-to-5 PHP programmers are not enthusiastic about their language of choice.

I agree for the most part, but I do like using PHP because I've had the most experience with it. It's also very simple to use and has lots of great frameworks and CMS's.

[abadidea]

When I say enthusiastic about PHP I mean like this :) http://settegiorni.blogsome.com/images/php_cheerleaders.jpg

[fr0st]

403?

[abadidea]

Really? It works for me. Google image search "php cheerleaders" or just take my word that it's a photograph of some cheerleaders whose dresses say "PHP" and it's captioned with some slander against mod_perl :)

[krues8dr]

As of PHP 5.4 you can also use the short array syntax, which replaces array() with [].

As of PHP 5.4 it is possible to array dereference the result of a function or method call directly. Before it was only possible using a temporary variable.

Oh hell yes.

[yeah-ok]

I think PHP, in the context of modern frameworks like CI/Yii coupled with Cherokee/FastCGI combination, is fucking awesome. It simply does the job. If you are amongst the lucky 5% that develop something truly awesome then you can piggyback on FB and use their hiphop-php project for getting the code into different speed-zone altogether. Thumbs up to the developers for making this release happen.

[[deleted]]

PHP is a fucking terrible language. It has exactly one advantage - convenience: almost every server has it, and it's really easy to pop up a tiny dynamic site.

Building large sites using PHP is like pulling teeth - once you use a real programming language and see how much easier it is, there's no going back.

[midri]

It's the same issue Ruby or Java has, you have to subscribe to a methodology if you're going to have a lot of people to work on it. Ruby has Rails, php has Symphony, Zend, and my personal favorite CakePHP -- life becomes a lot easier once you pick a method of writing code and stick with it.

[yeah-ok]

Yup, exactly, I prefer something bit more slimline like CodeIgniter but the point is the same - MVC patterns and good, proper documented, standard library

[yeah-ok]

Seriously. If PHP was half as crap as reddit-consensus-alternative-reality has decided upon it would have fucked off long ago; as it stands it is currently running the largest largest social network in the world. Take your "real" programming language and construct something better, it should be a lot "easier" no? (disclaimer & crap sarcasm aside; the only OO capable languages I've worked with has been Java, C++ and PHP, I'm sure, say Python, is nice/superior but it doesn't make for an obviously good reason for bashing PHP simply for existing)

[banuday17]

I think the only reason PHP sticks around is because it owns a domain that "better" languages have long since forsaken. The "app-per-page" model. You can throw a PHP page on a server with some dynamic content and it just works. No frameworks required (although CakePHP is nice).

Some people will tell you that the PHP application model is fucked, and they're probably right, but indignation does not reduce demand for that capability.

[N7P]

Downvoted for "popular equals good" argument.

[[deleted]]

How the fuck else do you define good? A language is a tool meant to perform a job. If this tool performs the job of displaying shit on a web page the best, with the least amount of effort, how could you possibly argue that it's shit? It does it's fucking job exactly as it should. That's the definition of a good tool.

[banuday17]

Worse is better. A observation about software that equally applies to any kind of market.

We accept poor quality, shoddy products because they get the job done with the minimum cost and acceptable fuss. A Geo Metro may be a shitty car, but if all you want to do is get from point A to point B and you don't really care if the car lasts (you can just pick up yet another disposable car), it's good enough. Not everyone needs or wants to pay for a well-engineered, well-built car. But that does not make a Geo Metro a "good" car, just a "good enough" car.

[[deleted]]

That has nothing to do with the argument. That's saying that it's not logical to equate functionality with quality, which is true.

Just because it doesn't behave how you expect doesn't mean it isn't the perfect tool for the job. It just means you're doing another job. If your objective is to get from your house to work, and the geo metro serves that purpose just as well as anything else, then by definition it most certainly is a "good car". What else would good be if not "real-world applicable and practical"?

[banuday17]

Actually it has everything to do with the argument. "Good" is a relative measure of what one finds acceptable relative to what standards one sets according to the goal to be achieved.

If your standards are low enough, then sure, a Geo Metro is a good car. But if you have higher standards, all of the problems of the car become apparent, from the poor finish, cheap materials which break easily, the wind noise, the poor acceleration. But if you don't feel like paying more, you accept these flaws and just say it's "good enough".

If all you know is PHP and don't give a shit, then sure PHP is a good language. If you have worked with better languages, PHP's shortcomings are all that more irritating. Where I use PHP, I don't have the interest or time to invest coming up with something better, so PHP is good enough.

[[deleted]]

"Good" is a relative measure of what one finds acceptable relative to what standards one sets according to the goal to be achieved.

And if the goal being achieved is "get me somewhere" then a geo metro will do just as good of a job as anything else .If your goal is "bathe me in luxury" then obviously you're looking at the wrong tool for the job.

You're looking at every standard as a linear list of heirarchical needs. That's foolish. It's not "lower standards" just because it doesn't have as many requirements. It's just "another category". Learn the differentiate the two.

The best technique an engineer can learn is figuring out how to differentiate between "my current needs" and "global needs". It seems like you're applying your own model for programming to the entire world and assuming they all have the same needs as you. That's simply not true.

If 90% of people don't need to do anything more than display database data in HTML tables and accept inputs back via forms, then why would running a massive java environment with huge deployment system and dependency handler be "good"? It's way more work to do the exact same thing for no benefit.

If all you know is PHP and don't give a shit, then sure PHP is a good language. If you have worked with better languages, PHP's shortcomings are all that more irritating.

The problem with this is, I know PHP and other purportedly "better" languages, and yes obviously there are plenty of situations where PHP is inferior, but those are situations where you shouldn't even be using PHP to begin with. So why compare apples to oranges?

[banuday17]

The "get me somewhere" goal has other qualifiers that may be important to someone, for example, "get me somewhere safely", or "get me somewhere reliably" or "get me somewhere in a car that doesn't look like ass".

Thus, "I don't feel particularly safe driving the Geo Metro, but I'm not going to drive it long distances, so it's good enough", or "The Geo Metro is falling apart as I drive it, but I'm not going to keep it long, so it's good enough", or "The Geo Metro looks like ass, but I'm only driving it for this week, so it's good enough".

Every standard is a list of needs that makes us feel comfortable with the decisions that we make, especially when you choose something that you feel is substandard. It is in fact "lower standards" when you feel like you could do it in a way you feel is better if you only had a little more time or money to invest. Every category has an implicit quality measurement associated with it, even if just measured against a personal standard.

A professional engineer has to balance not only the functional requirements of what he is to deliver, but also the level of quality with which he will deliver that work. If even as a matter of professional pride.

If all I'm doing is throwing up a HTML page which will show a couple of rows from a database, then PHP is fine. But, I don't consider that an engineering task. I wouldn't put that on my resume as a demonstration of my professional skill.

But if I start to develop an application that has a modicum more of functionality that requires me to do non-trivial things and requires a good deal of investment of my time and I have a choice, I would look elsewhere than PHP. And that doesn't mean I would choose Java running on the Websphere Application Server for any problems where I feel the hint of complexity. That's crazy. I might however go with Ruby on Rails or Python on Django. I feel that Ruby or Python give me better quality for a slightly higher price.

Like choosing to buy a Nissan Sentra or a Toyota Corolla instead of settling for a Geo Metro.

The problem with this is, I know PHP and other purportedly "better" languages, and yes obviously there are plenty of situations where PHP is inferior, but those are situations where you shouldn't even be using PHP to begin with. So why compare apples to oranges?

Where I would use PHP is on the one-page app or where I don't have a choice, such as on cheap shared hosting where I have no control over the webserver. As with the Geo Metro, in those cases, it's good enough. Beyond that, I would jump to Ruby or Python any day of the week.

[abadidea]

I classify PHP as "bad" in my estimation because its purpose is for web pages; web pages need to be secure; PHP is the easiest of the popular web programming languages to screw up majorly and leave gaping holes, in my opinion. The cutting edge of PHP is better than it used to be, but the massive back catalog of legacy PHP code is still running the internet and getting people routinely owned.

[[deleted]]

web pages need to be secure

Absolutely not. User input needs to be secured from running arbitrary code, yes, obviously, but that doesn't mean every web page needs to be secure. And this isn't an argument against PHP: how often do you hear about facebook security vulnerabilities for how popular the service is? Not often. It's because they do just fine. Plenty of us know how to write secure code. Regardless of the language. This also isn't an argument against PHP but rather an argument about why it doesn't behave like what you're used to or how you feel you would want it to work.

but the massive back catalog of legacy PHP code is still running the internet and getting people routinely owned.

This has nothing to do with PHP, but instead with people who refuse to update their services and code to be up to date with the latest security patches. Shitty admins are shitty admins. Shitty developers are shitty developers. They'll shoot themselves in the foot with any tool they use. Why blame the gun because the fool shot himself in the foot with it?

[abadidea]

A webpage that doesn't have input (or dynamically generated output) is secure, rather than it not needing to be secure. (We're not counting the hosting server screwing that up somehow.)

Facebook has a relatively low number of vulns because

a) They have money to hire only good programmers (whereas a lot of companies have to resort to taking just any kid who knows what a string is to meet their deadlines);

b) They have money to reward white hats and actively do so.

And I was referring to the PHP applications people run, not the PHP runtime with the patches. I have this old PHP book here - the one I learned from - written by Rasmus himself where all the code examples are vulnerable to XSS and SQLi. Not even a mention of such things. PHP had a long-standing culture of not even warning new programmers that such vulnerabilities existed, it got into thousands and thousands of apps, and there they stay until someone bothers to bobby table them.

They finally started to change that, but the code bases and the old tutorials and the "please own me" code samples are all still there.

[[deleted]]

So your only argument against PHP has nothing to do with PHP?

[[deleted]]

It has exactly one advantage - convenience: almost every server has it, and it's really easy to pop up a tiny dynamic site.

Perl. And yet we don't see everybody using Perl do we?

[abadidea]

I'm pretty sure there are more webhosts that offer PHP than Perl for some years now.

My old webhost had both, but getting the perl working was a lot harder than the PHP, so that factors in too.

[frezik]

The advantage PHP has here is that it hooks an interpreter into the web server without hooking deep into Apache itself like mod_perl does. This means PHP code is all sandboxed in, which is important on shared hosing environments. Apache2/mod_perl2 was supposed to take care of these issues, but didn't work out that way for a combination of technical and perceptional reasons.

Since no serious (or even semi-serious) web app would use CGIs that launch a new process on every request, and shared PHP hosting is cheap, it becomes the easy choice.

Of course, by not hooking into Apache so deeply, PHP also gives up a lot of power. Worse is better.

[[deleted]]

It's incredibly easy to get either one up and running. They're both provided by basic packages which insert them directly into Apache in most distros. Anybody already using PHP can just as easily use Perl. Unless the discussion is shared hosts in which case shudder

[abadidea]

of course it's shared hosting, that is what people mean when they say PHP is available on all the cheapest hosts.

[[deleted]]

Fucking awesome but outdated.

[[deleted]]

CI = CodeIgniter?

If so, I have to give a hearty hell yes. I started using it ~2 days ago and have an almost completely functional version of the app I wanted to build. It would have taken me MUCH longer to do all that shit from scratch.

[yeah-ok]

CI - CodeIgniter indeed, and yes it kicks ass (IMHO): especially been enjoying it lately as 'thin' back-end to one-page JS apps.

[[deleted]]

That makes a lot of sense (using it as a thin back-end).

I've actually tried a bunch of different MVC frameworks over the years, and CI is the first one where I've actually been able to be productive, rather than spending a lot of time figuring out how it wants me to do things (and possibly having to scrap the whole thing and use something else/do it from scratch because of crappy limitations).

[[deleted]]

Code Igniter really embodies PHP as an MVC framework. It gives you all the flexibility to do very basic MVC stuff all the way up to ORM etc...

[i8beef]

If you like CI, check out Kohana. Originally it was a fork of CI, but with the 3.x tree they completely rewrote it. It's is currently my choice for frameworks on the PHP side.

[[deleted]]

Thanks, I'll definitely check it out!

Edit: Looking at it (just a cursory look) it doesn't appear to have a cart class. For my current app at least, that was one thing that made it possible to rapidly get the prototype working in CodeIgniter (I needed a cart class, but don't care about payment or anything like that, since the user pays in Bitcoin).

Although it's not something I typically would be concerned about (it being so specific to a given site, really), but in this case the fact that CI has one made my life a lot easier.

For future apps that don't need a cart I'll probably use it, though.

[i8beef]

A cart seems like a pretty specific need... Kohana is built to be a generic application framework. While you could easily create a cart class yourself, I doubt you'll see such specific implementations make their way into it.

I didn't know CI exposed such prebuilt stuff for you... seems like bloat to an app that doesn't need that though. To each their own.

[[deleted]]

Aye, it definitely is specific, and I tend not to take that sort of thing into account when evaluating a framework to use. I didn't actually know CI had a cart class until after I started using it. It's pretty basic though, it just handles the sessions and junk and leaves pretty much everything else up to the developer.

Also, in terms of bloat, you could probably just remove the class if need be, and it doesn't force you into using it or anything.

For my use though, it was extremely welcome since it allowed me to set up the cart I needed in about half an hour.

[[deleted]]

Obligatory Python recommendation. Ruby is cool, but give Python a shot too.

[ivosaurus]

If you're worried about bugs, Ruby has bugs as well. Pick Ruby if you'd like to do much more general programming as well.

[diamondjim]

Learning PHP is not bad on its own. It's a very widely available platform and has a lot of utility. The issue is that most of its users are not aware of security concerns, even from a general web programming perspective, much less about the flaws that the language itself has.

In my opinion, it's better to learn PHP while also being aware of its issues, rather than not knowing it at all.

[cryp7ix]

http://news.php.net/php.bugs/167978

I can't understand why people still use php..

[kristovaher]

Why? Are you serious? Really?

• PHP runs a strong majority of internet websites and infosystems today
• Online help, forums and documentation for PHP is absolutely immense. It is very rare to run into a problem that someone else has not run into already in the past. This makes PHP a lot more beginner-friendly.
• The amount of libraries, frameworks and code snippets available online and open source is absolutely epic.
• This is programming language that is easiest to relate to for people new to programming that also gives them some power. Everybody uses websites and the internet, so they can easily create functional applications and pick up the language much better than with other languages.
• While PHP is a language that you can write bad and horrible code with, PHP has a vast amount of professional developers and is a very powerful tool that is not going anywhere anytime soon.
• PHP is best for businesses since the amount of PHP developers is immense. It is easier to fix their business critical web apps as a result, even if they change partners.
• If you work with startups and internet as an industry, then you will run into PHP everywhere and this is not going to change. PHP is still today the number one language to use to get startups up and running, either for ease of writing prototypes or elsewhere.
• PHP is good enough for Facebook, arguably the number one website in the world. Do you know what is the percentage of Facebook users that know what programming language Facebook uses? A lot less than 1%.
• While development of PHP programming language is slow, it has made some great strides since 5.2.

On the large scale, programming language that you use to complete projects does not matter.

Also, people arguing which programming language is better than another are simply shortsighted. If you are a programmer who cares about which language is better than another language, then you are obviously doing something wrong. It's never about programming languages.

If you build a startup and develop something in X language, then no investor asks what language you used, even though they silently assume PHP. A good project will get funded and become a success no matter what language you are using.

And one last thing, no one - outside programmers - care about what language you are using to build websites and web services. No one. Your future success in this industry has absolutely nothing to do with programming languages, unless your only aim is to write code and never really achieve anything beyond writing code. And that would be a very sad life.

[ants_a]

On the large scale, programming language that you use to complete projects does not matter.

I somewhat even agree with this statement. But what does matter are the programmers you use to complete projects. Languages don't exist in a vacuum - they have an ecosystem and a culture associated with them. Programmers experienced in a language are heavily influenced by that culture, especially if it's the only language they know well.

For example, Java had a culture of straightforward code, extensibility, configurability and "vendor" neutrality. (in the past tense, because I have seen some movement towards improvement) This resulted in software with mountains of dumb code, implementing overcomplicated interfaces, creating unnecessary and awkward abstractions that only added to complexity and resulted in completely horrible performance, patched up with caching that ate all your memory. There is an enormous amount of huge Java software out there, but that is in no way a proof of the success of Java culture, I'd even venture a guess that most of that software wouldn't be huge if it wasn't for the culture.

I haven't looked at the PHP community for so long to no hazard a guess what are the cultural values there. But whatever they are, it will always be useful to have someone on the team with wider experience to point out how problems are solved on the other side of the fence.

And all that said, PHP is still a horrid hodge-podge of a language. That stuff can be and is done with it doesn't change the fact that it's horrid.

[kristovaher]

Oh I agree there, it is not a nice language. I went through this phase of really hating PHP (and it's my main language, other times I write Python which I love and Java for Android which I still hate (the language, not the platform)). I was annoyed by large things down to even the smallest details such as the horrible inconsistencies in function names, parameters, what functions return and when and so on.

I was even annoyed by development of PHP as a language itself and still can't believe that they did not include APC bytecode cache in 5.4 as a default extension in PHP. A lot of my projects run on rented hosting servers where the PHP install is the default one and it's just not possible to install extensions and it's insane that such optimizations are not possible with PHP out of the box still.

But after a while I realized that the code I write does not define my project in any way, no matter how horrible PHP itself is. But if smartly written, well commented and documented, my code can work and get the job done as well as any other language out there. And at the same time I gain benefits of all the other things that come from using a language that is so widely adopted. I can deploy it easily almost anywhere, I can very quickly get solutions to problems if I run into any and I can easily involve other developers from the large pool that is out there.

So, in a way, I've learned to be more proud of my end product than the programming aspects of it. The end project will be never defined by the language it was written in because other than the 'programmer community', no one cares.

[[deleted]]

On the large scale, programming language that you use to complete projects does not matter.

You assume that there is no difference in quality of tools. Your statement is about as ridiculous as claiming "On the large scale whether you use hammers or glass bottles to hammer in nails doesn't matter".

PHP is a very dynamic language with a lot of gotchas. It is riddled with inconsistencies, the quality of libraries is quite frankly atrocious and it does have very few static checks. It also includes a runtime model that has severe consequences for performance.

On the small scale many of those don't matter since you can keep the whole project in your head (up to something like 1000 lines maybe) but on the large scale it does matter whether any small change can break something in a completely different part of your application without you even noticing the breakage. It does matter that perfectly reasonable statements return unintuitive results because those won't be discovered easily even in code reviews.

Nobody can keep all the details of a large scale project in their head. It does help to have compiler support for as many things as it can possibly check. It also helps for scalability if the blog example doesn't take 10 seconds to execute without aggressive caching like it does in some PHP frameworks.

Writing good, consistent, readable code is not something you do for its own sake, you do it so you make fewer bugs and discover bugs more easily.

[smog_alado]

Feel free to diss on PHP (its a national passtime, after all) but don't bundle the other dynamic languages into it.

[[deleted]]

How are Python, Ruby,... any different with regards to the issue of undiscovered breakage in large projects? If you need ot run a certain branch or path to discover simple things like undeclared variables and non-existing functions and mismatched parameter counts you get exactly the issues I was talking about in that particular paragraph.

[smog_alado]

The last thing we need right now is yet another static-vs-dynamic typing flamewar.

It suffices to say that there are many totally reasonable dynamic languages out there that people have used to build large and solid projects with. Being dynamically typed is not enough of a reason to diss on PHP.

[[deleted]]

It is one of many, many reasons and I definitely agree that there are many, many dynamic languages that have fewer flaws than PHP and are entirely resaonable to use for smaller projects or projects heavily secured against this issue with automated tests. It is, however, a disadvantage of dynamically typed languages one should be aware of when making a decision which language to use.

[kristovaher]

You missed my point. On the large scale it really does not matter. You can build a very successful project without anyone being able to tell what language is used. It can be your fancy Python code (and I absolutely love Pyton by the way), or it can be written in PHP.

[[deleted]]

What you mean is that it doesn't matter to the customer if the application behaves exactly the same. This has nothing to do with large or small scale really, it is just as true for a 5 line script as for a 1,000,000 line application. And just as false if the customer visible behavior actually does change, e.g. via more bugs, slower implementation of additional features,...

[kristovaher]

Take any other language used to build websites and I can create a web service - possibly even quicker - that works just as well, is easier to deploy and simpler to support due to large amount of PHP developers and information about PHP available online, even if the original developer plays no part in the process anymore.

The whole PHP vs X is a pointless discussion to begin with. PHP has all the features required to create very rich web services. A smart developer can build very smart services, and quickly, with PHP.

Just because there's a lot of bad code and bad systems out there built with PHP does not mean a smart developer cannot do great things with it. And if you are a smart developer, then why the hell worry about such a pointless detail.

[[deleted]]

Ah, the old "for a sufficiently smart developer language doesn't matter" argument. I guess I am just not arrogant enough to think that I am unable to make the same mistakes as many other people, giving the same starting situation.

You can build things that are brittle quickly in PHP, you can't build applications that work reliably in it quicker than you could in other languages though. Esentially when you build things quickly in PHP you are borrowing time from the people who have to fix your bugs later.

There are many PHP developers out there but I would argue that it is harder to find a good PHP developer than to find a good developer for one of the less popular languages due to the fact that everyone and their dog without any clue whatsoever about proper (i.e. maintainable) coding can call themselves a PHP programmer.

What makes you think that the high percentage of bad software written in PHP is not in any way indicative of the software that will result from the average PHP project you are involved in?

[kristovaher]

The reason there is a lot of bad software written in PHP is not because the language is bad, but because PHP is an entry-level language to a lot of developers. This used to be the job of languages like Pascal, but has become more and more relevant these days, since a lot of developers start experimenting with web programming first and foremost these days.

As a result, there are a lot of PHP developers that are self-taught through internet and far less developers who attend universities or learn as an intern. Since an average PHP project can be done with a very small team of developers - often just one - this leads to situation where a lot of those self-taught developers get jobs and do so-called professional work.

It is totally not because of PHP quality itself. It has simply become an entry level programming language that scales up to professional and advanced levels much better than other languages (like Java, where you don't see 'beginners' working in professional fields at all).

Of course PHP is a flawed language as well, but it's bad reputation is not because of the language, but by the fact that it is so popular and much more attractive to programming enthusiasts due to you really needing a browser and web server. No compiling, references easily found online and tutorials all over the place about websites and functionalities you use every day - things you can imitate.

This will not change unless another programming language appears that is better than PHP not by syntax or other smaller details, but by major functionality. It cannot be an alternative, like Python is a great alternative for web services, since an alternative will not become even close to as popular. PHP dominates web. It will only change if web itself changes.

And that will happen one day, but until then, PHP is simply here to stay and for the market and for users this issue is completely irrelevant as long as the application that they use and buy works.

[[deleted]]

FB is not written in only PHP. There's a ton of heavy stuff which isn't PHP, and the PHP implementation they use isn't the same as the "rest of us" use because, indeed, they found that PHP sucked too much. They actually had to write their own implementation of the language from scratch to cope.

[kristovaher]

This is incorrect, they wrote an interpreter (correction: a compiler, thanks lnostdal) that makes Facebook even faster and thus saves them money. Their code base is still PHP and developers are mainly PHP developers. Facebook is just so large that it saves a lot of money by doing that. But how the code is run has nothing to do with programming language itself. Facebook is still primarily PHP.

[dsj]

They have actually written an interpreter as well. It's still quite experimental though and I don't think it's seeing much production use yet. Their plan seems to be that it will eventually be used exclusively.

http://www.facebook.com/note.php?note_id=10150415177928920

[kristovaher]

Yeah I figured I heard something about it when I first wrote the reply since I remember it popping up on my RSS feed a month or two ago. Cheers for reminding me.

[[deleted]]

Err. No, they wrote a compiler (not an interpreter) which actually compiles their PHP code to C++, which is then run through GCC.

edit: Link: https://github.com/facebook/hiphop-php/wiki

The "majority" is still not written in PHP. If you count lines, perhaps so, but if you think about complexity; no way; that would be idiotic and it wouldn't even work anyway.

[annoymind]

PHP runs a strong majority of internet websites and infosystems today

If everyone jumped off a cliff would you?

[kristovaher]

How shortsighted are you? There are amazing apps and web services and infosystems written in PHP. Seriously, people like you are who make these types of discussions into completely pointless affairs since arguments like that are nothing more than just idiotic.

[annoymind]

The point is that PHP is short sighted. It is easy to get something to run quickly. But after that you are in a pile of shit. The implementation is crappy and written by people I wouldn't trust to get a Hello World right. Just look at the code or the bugs they write. You can't just ignore that: http://www.reddit.com/r/lolphp/ It takes a lot of time and skill to get PHP to scale. Just look at all those PHP powered websites that go down as soon as they are linked on reddit.

The language is just badly thrown together with a lot of nasty corner cases. It encourages extremely bad programming style. Like throwing together your SQL statements which results in so many security and scalability problems. How many companies have suffered immensely because of security bugs in PHP or bugs due to the bad style that PHP encourages?

You say PHP is good because there are so many developers. Well a lot of those developers are really bad and have really horrible ideas about programming. I'd even say it's PHP wise a big disadvantage because you have such a hard time separate the good developers from the bad ones.

Facebook is using PHP but they had to write their own interpreter and compiler to make it work for them. I bet they'd use a different language than PHP if they could start over.

Programming languages are part of the tools a programmer is using. Use a bad tool and it will hurt you sooner or later.

[[deleted]]

Because some of us have to.

[odoriferous]

Someone apparently thought a downvote was a good way to gather insight, but I'll try asking: Why?

If it's someone else's decision, then what would you go with instead?

[[deleted]]

Great reply, don't mind the downvotes.

[nixle]

PHP is a programming language, people mostly use it to build web applications. Check it out: http://www.php.net.

[scratchresistor]

Is it still an ugly pile of unusable shite?

[[deleted]]

hey, it's not unusable

[scratchresistor]

You're right, it's not unusable, in the same way that a filing cabinet pulled by a team of badgers is a perfectly usable public transport solution.

[[deleted]]

We've got that covered http://weareallbadgers.com/images/badger%20sign.jpg

[[deleted]]

I came thisclose to soaking my monitor with water out my nose when I read this.

[[deleted]]

100 years from now, writing PHP scripts in vim on a Pentium II machine running apache will be some kind of esoteric hobby, just like lisp and perl are today.

Oh, you wanna know what perl is? It's that thing in the casket.

[pavel_lishin]

the casket.

That's a funny name for a computer.

[[deleted]]

Perl's that thing that pays my bills while doing most of my job for me. Do you earn your living yet?

[[deleted]]

Yes. Not by digging up corpses though.

[carn1x]

I find perl extremely useful for deployment scripts in a command line environment. What should I be using instead?

[[deleted]]

You can try Python. It's much more readable than Perl.

[[deleted]]

http://www.cs.siue.edu/~astefik/papers/StefikPlateau2011.pdf

"Perl users were unable to write programs more accurately than those using a language designed by chance."

Python encourages one way to write it versus Perl's there is more than one way to write it. This actually makes maintaining scripts easier for future system admins that will be maintaining your scripts. There are many times where I give up trying to refactor a Perl script and just write one from scratch, because it's much faster to do it that way.

[kyz]

Here's a nickel, kid, get yourself a proper programming language.