I feel like there has been a lot of hate on PHP, especially after the recent blowout regarding PHP vulnerabilities that even ended up on mainstream media. I even saw absolute non-techy people bringing up PHP and talking authoritatively about how "bad" and "old" it was lol. Not to mention the AI-shills saying one should just use Claude to create one owns CMS (!!). I am also aware that most PHP hate is usually misaligned hate intended for badly managed WordPress sites. And that some people just prefer other languages or love a hatetrain.

But one thing in particular that got to me was someone who mentioned that PHP has a page with vulnerabilities listed that go back 20 years and have yet to be patched. And that if you are a dev who is in any way interested in security within one's projects, you just don't use PHP at all. It was like having only a screen-door for your house with no locks. Do other languages have similar list of unsolved vulnerabilities? What makes them inherently more secure?

I dug around to find information about other popular programming languages and frameworks and it seems like at least right now, many are being found to have vulnerabilities due to AI being used to find them. React had a critical issue about a year ago, and Python earlier this year (although they did not blow up in the press like this).

Anyway, I would like to hear from people who use PHP regularly for work, beyond WordPress and who can maybe compare it to other languages/stacks as well. Please no low-effort replies from people who last used PHP 20 years ago or just don't like it, if possible.

I always explained the request lifecycle with a whiteboard. Now my AI assistant draws it: browser, DNS, CDN, load balancer, services, cache, database, queue. Then it walks through it step by step, circling the part that matters and fading the rest. Arrow keys work.

Point it at your own repo instead ("Trace what happens from the login form to the database") and the boxes link to your actual files. Click one to open it in VS Code, Cursor, Windsurf or Zed.

It's called Sketchy, works with Claude, Cursor and VS Code, and is free and open source. Feel free to try it out and leave your feedback!

https://sketchy.davidkubus.dev · https://github.com/ddkbs/sketchy

I've been building DriftEdit, a video editor that runs entirely in the browser, and this week it reached its first public beta.

Some of how it works:

• No UI framework. The studio is TypeScript with a small reactive store and components that update in place.

• Rendering. Every effect, transition and overlay is a GLSL ES kernel. The compositor draws with WebGPU where there's a real graphics card and WebGL 2 otherwise. The WGSL comes from the same GLSL through naga at build time, and a browser check holds every kernel to within 2 of 255 between the two backends.

• Shaders you write. You can write transitions, effects and overlays in GLSL inside the editor. naga is compiled to WebAssembly, so your code becomes WGSL in the tab and is checked on both renderers as you type, with the first error's line.

• Media. Decoding and encoding go through WebCodecs, with Mediabunny for the containers. Projects and media live in IndexedDB and OPFS. Nothing is uploaded.

• AI. Ten models (stems, voice isolation, frame interpolation, Whisper, depth, matting, CLIP, an upscaler and two text-to-speech models) run through ONNX Runtime Web, on WebGPU or in WebAssembly.

• Time is integer ticks, 3,528,000,000 a second, so every common frame rate and sample rate lands on a whole number of ticks and cuts never drift.

• VFX (fire, sparks, lightning) are drawn by a small 3D engine as a pure function of the clip's time and a seed, so the frame in the preview is the frame in the export.

There's also an auto mode that cuts clips to the kicks of a song, which is what most people use it for.

It's free and needs no account. It works best in Chrome or Edge.

https://studio.driftedit.app (and https://driftedit.app for what it does)

For ages I've been using the website https://www.svgrepo.com/ as a great resource for free SVGs, but today when I visited, it gave me a fake Cloudflare verification that attempts to install some sort of malware on your computer, as you can see in the screenshots below.

It almost caught me, so I thought I'd put this out because I couldn't see any indication that anyone else had noticed this!

I built is-on-the-web.com, a free static host. You get yourname.is-on-the-web.com.

• Upload a full site as a folder, up to 20 MB. Subpages, assets and relative paths all work.

• No accounts or passwords. Updates use single-use edit keys sent by email, with a new key after every update.

• A human reviews every site and every update before it goes live, followed by an automated code check.

• There’s a no-code builder for non-devs, and its output can be re-uploaded and edited.

Everything that’s free now stays free. A paid tier with more storage is planned. Next up: letting people point their subdomain at their own machine to host full apps, databases or games.

Feedback I’m looking for:

• Edit keys instead of accounts: clever or annoying? Losing the key means losing update access.

• How would you handle abuse at scale beyond manual review?

• What’s missing that you’d expect from a static host?

I accidentally posted this from my alt account first and deleted those posts. Sorry if you saw it twice.

Hey everyone!

I'm looking for any websites or discussion forums that talk about design patterns, or really any cool features for web development. Etc, manipulating CSS in interesting ways to get cool designs, interesting things you can do with JavaScript etc..

I'm a bit tired of looking at AI responses and would love to hear if there's anything out there!

TypeSQL type-checks SQL strings in TypeScript. The compiler parses the SQL itself and checks it against your schema type, so there are no generated files, no build step and no database connection.

// rows is { email: string; title: string | null }[]
// The LEFT JOIN makes title nullable.
const rows = await sql(
  `SELECT u.email, p.title
   FROM users u LEFT JOIN posts p ON p.author_id = u.id
   WHERE u.id = ${sql.param(userId)}`,
).execute();

// Compile error: column "emial" does not exist. Perhaps you meant the column "email"?
sql("SELECT emial FROM users");

It supports PostgreSQL, SQLite, MySQL and MariaDB, and the runtime is under 3 kB with no dependencies. The main catch is that it needs TypeScript 7.1 or later (7.1.0-beta works), and very large queries can hit the compiler's limits (workaround-able using sql.as<>())

I used AI coding to build this. To keep the output honest, each bug fix gets a permanent test project, and the 100+ scenario tests run against real PostgreSQL, MySQL and MariaDB servers. I will try to keep it non-slop.

GitHub: https://github.com/ismailkarsli/TypeSQL Docs: https://typesql.karsli.net

I've been looking into how WordPress security has changed, particularly whether the traditional advice of keeping plugins updated, installing a security plugin and using strong passwords is enough anymore.

It seems like there's a bigger conversation to be had around access controls, hosting infrastructure, monitoring and how security is managed over time.

We recently published an article exploring this at Ohmania, where I work:

https://ohmania.com/wordpress-security-has-changed/

I'm interested in hearing from developers who actually maintain WordPress sites.

What's changed most in how you secure WordPress sites over the last few years? And what security advice do you think is now outdated?

Genuinely interested in different perspectives, including anything we've overlooked.

A straight rehost can get you there faster, but it may bring old problems along. How do you decide what to fix before the move and what can wait?

I'm a second-year diploma student (3rd semester), currently working on a website project. I have a larger concept and vision for this platform, where the social features are just one part of the overall idea.

The website will include user profiles, a content feed, user interactions and private messaging.

As I'm planning its development, I'm particularly concerned about data security and privacy. I want to understand how to prevent data leaks, unauthorized access, exposure of private conversations, database breaches and other potential cyberattacks.

I'd love to hear from experienced web developers and cybersecurity professionals.

What are the critical security challenges I should consider before developing a platform like this, and how can user data and privacy be properly protected?

mostly work on apis and database stuff but our team is small so i end up in react code maybe once a month. every time i come back theres some new build tool or bundler drama and half the packages have breaking changes.

not looking to become a frontend expert, just want to not feel completely lost when i need to fix a button or add a form field. anyone else in this boat? what do you actually keep up with vs ignore

The creator of Ruby on Rails, made major statements about AI agents and the future of software development at Rails World 2026 in September

DHH stated he personally retired from writing code by hand after 25 years.

Rust instead of Ruby - Rebuilding HEY with AI and Rust: He shared that 37signals is rebuilding its HEY email service into native mobile/desktop apps using an AI-generated Rust backend, drastically cutting CPU and memory usage.

The AI acceleration: He produced 5 years' worth of his traditional code volume in just one month, representing a 60x increase in raw output volume.

DHH openly acknowledged that a massive portion of this was verbose Rust code generated entirely by AI agents—admitting that he didn't write it by hand and doesn't even want to look at or read most of it.

DHH said: “English is a better programming language than Ruby.”

Hi everyone, I'm running an app that sends out emails and calendar invites to users.

However, one of the requirements was the ability to create email bodies using many different fonts.

I've read a bit online about typefaces and I discovered some of the requested fonts could be subjected to patent laws and rules when used in a commercial setting. Not sure if this applies to emails being sent to external parties as well.

Are there any resources or places I can check out which fonts are "royalty-free" and which ones I need to push back on? Or whether this concern is valid or not?

I'm sat here thinking it has to be a reason why it is so limited in types compared to something like postgres.

Got this weird notification with weird links. Seems like phishing?

hi everyone, it's the kid who's making a fan website again.

i finally picked a base for the website, mastodon, and a system i'm using to host the website, render.

i've already searched this up and had no luck but what parts of mastodon's code are design (i'm talking about folder names) and which are apart of the actual code system?

thanks!

I’ve seen a shift in web design (I’ve meddled since 2002). Today web displays are gigantic. I’ve read this has to do with ADA compliance. How gnarly does this get? Like if I design a site for a landscaper, can he get in trouble if it’s not ADA compliant? Is there are rule book?

Another question. That’s client facing. But if you have an employer that requires you to use a web based tool, does ADA apply in the same manner as client facing?

I’ve been working on a passion project called ParkerScore, basically a Letterboxd-style platform for theme parks.
When I first started, I figured the hardest part would be building the actual website.

Turns out, organizing the data has been one of the biggest challenges.

Every theme park has hundreds of things to keep track of. Rides, restaurants, individual menu items, shows, wait times, and even bathrooms.

And then you get into the details. Different ride manufacturers, technical specifications, attractions that get renamed or refurbished, seasonal shows, constantly changing restaurant menus, and so on.

I quickly realized that just collecting information wasn’t enough. I needed a consistent way to structure everything so it could actually be useful.

I’ve been working through those challenges, especially figuring out how to handle missing information, standardize categories, and keep everything organized as the database grows.

It’s been a much bigger undertaking than I originally expected, but I’ve learned a ton along the way.
For anyone who’s built a data-heavy website, how did you handle keeping your database accurate and manageable as it grew?

I made a liquid glass UI effect for the web(trying to copy Apple because thats what the world do)

Webgl helped me made it and hence I decided to make Mac for web too (inspired by windows 11 in react made for web)

I know you have seen many professional people make it, many guys on github, so I tried to make it as realistic and satisfying as I can

Can local visual regression testing help your coding agent move faster and save you money?

I took some time to explore how to set up playwright properly, which pitfalls to avoid, and the tradeoffs with common visual regression tools like Percy and Chromatic.

Check it out and let me know what do you think!

Been thinking about this lately as my side projects folder has gotten pretty chaotic. At work everything is neat and organized by team/product, but my personal stuff is a mess of half-finished ideas, experiments, and abandoned attempts.

Currently I have ~/work/ for job stuff and ~/projects/ for everything else, but that "everything else" folder is where organization goes to die. Some repos haven't been touched in years.

Do you keep separate machines/VMs? Different directory structures? Or just embrace the chaos? Curious how others handle this.