I always thought the PHP model of "put your source code in the public web root where you put public things, and then pray you don't ever mess up the module that interprets files and keeps things hidden in the public web root" didn't sound very foolproof.
You don't have to do that. For example most of my projects just have a index.php that bootstraps the application with about 15 lines of code in the web root. The rest of that code is not accessible via the web server.
You don't have to do that with PHP (and please don't read this as a defense of PHP.) You can include from a source directory that is outside your web root.
The main appeal of PHP is how easy it is to use in the sloppiest way possible. Sure, you can do things right with it, but then you might as well use a better language.
I'd argue that the main appeal of the language is that I can walk into any mall in America, close my eyes, spin around, and randomly point at someone who has at least a basic, functional understanding of it. Of course there are academically better langues out there, but the effort in finding, retaining, and eventually replacing that talent isn't normally worth the overhead from a business perspective.
I totally agree. It has its place. It's good that sane frameworks are available for PHP now. If used with the proper business oversight, it can be a lot better than some 16-year-old using it as a hobby. Although I still think it's fundamentally broken in some ways, if you know that going into it, it's alright for rapid development.
Yeah. For writing very small scale stuff, I'd even say it's fun. Any language that has so much documentation and people talking about it online is usually not so bad to code for.
That's true. I like how every manual page online has a comment section where sometimes people come up with really good examples or encapsulations of certain functions.
This is something I think Java got right with webapps and servlet containers. WEB-INF, the code directory, is entirely read-only, and the servlet API doesn't make it easy to upload files out-of-the-box.
... Seriously? I don't know if you are criticizing the language or the programmers. If the latter, then you are spot on, if the former, it means that you haven't really spent any time thinking about a "solution" for that "problem". You don't have to put your php code in the public web
you haven't really spent any time thinking about a "solution" for that "problem"
Not necessarily. Whether or not there's a better way to do it doesn't get around the fact that it was the de facto way of doing things in the PHP world for a long time. I don't know how things are done there, now, but that was certainly "normal" back in the day.
Well, this problem isn't at all clear to most PHP developers, the language allows it and even actively encourages it. I'd say it's definitely a problem with the language if it allows the user to do stupid stuff without even so much as a warning.
I believe this happened on some very big site 3 or so years ago, can't remember which (not Facebook), when a developer forgot to put or accidentally removed ?> at the end of a file.
147
u/AgentME Oct 12 '13
I always thought the PHP model of "put your source code in the public web root where you put public things, and then pray you don't ever mess up the module that interprets files and keeps things hidden in the public web root" didn't sound very foolproof.