Folks, if you parrot opinions like "PHP is an insecure language" or "PHP has inherent security flaws" in 2024, and you can't point to specific issues with modern, current versions of PHP to back it up, all you are doing is demonstrating your ignorance.
The fact is, modern #PHP is every bit as secure, solid and performant a server-side #programming platform as #Node, #Python, or many other popular languages.
I hadn't looked at PHP in a long time, so I picked a prominent part I didn't like, the "associative arrays", and took a look at it again. It still has all the same issues, down to "only string indices". It is still a weird chimera of "ordered dictionary" and "hashtable".
It seems now there are over 1000 built-in functions, all magically appearing in your variable space.
Another of my big issues was passing functions as a parameter.
@andrewfeeney When I was writing PHP, the only way to do this was to pass the name of the function as a string, and then later check if that string name is "callable". God forbid that two functions have the same local name...
Apparently they introduced a solution to this in 4.0, and deprecated it in 7. The new solution is to create a lambda which simply calls the function... which is a little better, I suppose.
But I can't even imagine how you'd do forwarding of arbitrary arguments!
There's no real type checking.
Naming is all over the place: quoted_printable_decode does the same as imap_qprint, "convert a quoted-printable string to an 8 bit string", except the second one needs IMAP for some reason.
Many functions used to accept arguments in any order, and then determine which parameter went where by type! I see a lot of these disappeared in PHP 8.
@ramsey@TomSwirly The only type checking I can think of which is available in some strongly typed languages but not PHP is generic types. You can workaround this using annotations with static analysis. Pretty much everything else I can think of that you might want is now a feature.
The creators of PHP made it clear that they had no plan, ethos or aesthetic guiding them - they simply added a lot of features as fast as they could.
I was interested to see how PHP has changed in the last decade or so, but this thirty minute dive made me very happy I will never write in that language again.
(That said, a talented programmer can write good code in any language.)
@TomSwirly@andrewfeeney Haha. This is because PHP didn’t start its life as a programming language. It started out as a wrapper around C functions that could run on a web server.
@tappenden For sure, nobody is suggesting you write your data science scripts in PHP, because environments like Python have the tooling. But let me tell you, I've seen some gnarly Python out there in the wild. Easily as messy as some of the wild PHP from back in the day. Does that make Python bad? No!
Yes, it's got a history. We know the history well. We know the painful ways of old. Yes, there is unpatched and otherwise insecure legacy code out there in the wild. Yes you can find examples of terrible code in old blog posts. But if you haven't updated your opinion since that time, you are running on outdated intel.
We learned the hard way. We hardened our language, our knowledge and our practices as a community over decades of experience making popular and profitable web applications.
#PHP is a living language with a vibrant, thriving and extremely knowledgeable community. Is PHP the best language? That's subjective. Is it a solid and trustworthy option for a modern web app or back end service in 2024? Absolutely.
You may hate the language and that's your prerogative. Everybody has their preferences & they are valid. But if you want to accuse PHP of general vague badness or insecureness, you better have specifics to back it up. Specifics that apply to PHP in 2024, not 2012.
@andrewfeeney when I was a web developer, one of the annoyances outside the language was how much old, out of date documentation & common practices were still out there and very easy to find. Like using the mysql_* functions in 2018, without any info on safely escaping data (not even thinking Frameworks, but "how do I X in PHP").
Add comment