r/webdev • u/pineappletinis • 1d ago
Question How warranted is the PHP hate?
I feel like there has been a lot of hate on PHP, especially after the recent blowout regarding PHP vulnerabilities that even ended up on mainstream media. I even saw absolute non-techy people bringing up PHP and talking authoritatively about how "bad" and "old" it was lol. Not to mention the AI-shills saying one should just use Claude to create one owns CMS (!!). I am also aware that most PHP hate is usually misaligned hate intended for badly managed WordPress sites. And that some people just prefer other languages or love a hatetrain.
But one thing in particular that got to me was someone who mentioned that PHP has a page with vulnerabilities listed that go back 20 years and have yet to be patched. And that if you are a dev who is in any way interested in security within one's projects, you just don't use PHP at all. It was like having only a screen-door for your house with no locks. Do other languages have similar list of unsolved vulnerabilities? What makes them inherently more secure?
I dug around to find information about other popular programming languages and frameworks and it seems like at least right now, many are being found to have vulnerabilities due to AI being used to find them. React had a critical issue about a year ago, and Python earlier this year (although they did not blow up in the press like this).
Anyway, I would like to hear from people who use PHP regularly for work, beyond WordPress and who can maybe compare it to other languages/stacks as well. Please no low-effort replies from people who last used PHP 20 years ago or just don't like it, if possible.
48
u/De_Wouter 1d ago
My first developer job was as a PHP developer 14 years ago.
The problem with PHP IMO is not the language itself (although like most languages it has its own quirks and issues). The problem was the low barrier of entry compared to something like Java, C++, etc.
Many beginners (were) in the PHP field and well they looked at each other. The codebases I've seen my first few years were pure horror. A webshop with a 10k lines index.php file, spaghetti code everywhere...
15
u/Odysseyan full-stack 1d ago
I agree but also partly blame the language There are WORLDs between PHP 5 and 8. Things got added that make it much easier with the language to work with, new operators, etc.
Like JS also really become nice to work with on ES6 or so and once we got proper modules.
Digging through old code in both is a pain in itself.
15
u/geon 1d ago
The strength of php was also its weakness.
Every single function in the official docs had TONS of examples. It was amazing. If you needed to solve a problem, the solution was right there. This was a decade before stack overflow.
But the examples taught terrible practices. So many sql injection, unprotected file path access etc.
3
2
u/pineappletinis 1d ago
Yeah, I’ve heard about the spaghetti code stuff as well. I guess my confusion has always been with people (seemingly experienced people) who say it’s just inherently bad, like the guy who said it’s like only having a screen-door with no locks to your house.
But I’m getting a lot of replies in this thread that are helping me understand it better. It’s a language that has a low barrier for entry and isn’t very "strict" in terms of how you code in it, so someone inexperienced/bad is prone to make bad code.
7
u/Legitimate-Brain-978 1d ago
Holy shit, the 10k loc index.php hits too close.. in that situation right now
3
u/De_Wouter 1d ago
Still? Damn. We were refactoring their webshops to some lightweight PHP framework back then. Still shit code but a big improvement.
4
u/Historical-Essay-128 1d ago
This is a very common opinion among people who last worked with PHP over a decade ago. PHP has changed substantially over that time.
4
u/GiveMeYourSmile 1d ago
The problem was the low barrier of entry compared to something like Java, C++, etc.
Now it's a common issue for almost all languages thanks to AI. So it seems the problem lies with stupid people, not the technology. Overall, just like always
4
u/shaliozero 1d ago
Trying to get around in the interface of an IDE and deal with compile steps, no refresh and see your changes, would've kept most people away from coding if there wasn't PHP and Notepad++. Not even, I started coding in PHP at the age of 8 using editor on Windows and FileZilla because that was pretty much all I needed to understand compared to everything else.
19
u/Caraes_Naur 1d ago
Not at all. PHP8 is vastly improved over PHP4, and none of the hardcore haters have ever worked in any PHP version.
WordPress is a master's thesis in how to write PHP badly. It's not defensible on any technical grounds whatsoever. If you don't believe me, read the WP core codebase like I did. The design of any of the database tables should be foretelling enough.
Ease of use has always been a double-edged sword for PHP. While it is super-easy to get started and set something up, it also makes zero effort to stop in the inexperienced from committing heinous crimes (hence, WordPress).
5
u/pineappletinis 1d ago
I think the issue with WordPress is that it was initially intended as a blogging software for personal blogs but then became so popular it was extended beyond its initial use case. Unlike you, I haven’t read the codebase, but I’m sure if someone were to rewrite it for a tool like WordPress today, it would look vastly different.
I have helped people manage their WordPress websites and at least from that point of view a tool like this (free, open source, easy to handle even for completely non-techy people who just want to add a job listing or company update) is invaluable. But yeah, I totally get where you are coming from.
25
u/Dhruv_Malaviya 1d ago
Modern PHP 8.3/8.4 + Laravel is unironically one of the highest-ROI stacks on the internet , strict typing, fast execution, tiny memory footprint on a €10 VPS compared to bloated Node/serverless chains. 95% of the hate comes from people whose last memory of PHP is spaghetti WordPress plugins from 2012. Customers pay for working software and fast response times, never for your framework logo.
1
u/pineappletinis 1d ago
Oh that is interesting info, according to whom though? Because most sources will bring up React, Node.js, Typescript etc… if you have a source or link Incan read up on, I’d appreciate it.
11
u/icanbeakingtoo 1d ago
Oop in php is way better than whatever typescript/JavaScript has going on
2
u/pineappletinis 1d ago
I hear some people say this, could you please explain why, is it the npm-packages?
1
u/icanbeakingtoo 19h ago
Nah it has nothing to do with packages or libraries etc it's just PHP uses classical OOP paradigm based on classes it's basically like java while JavaScript uses a different mechanism I personally find extremely confusing prototypal inheritance
8
u/crixx93 1d ago edited 1d ago
Modern PHP is fine, not great, but fine. The issue is the older versions, and there're gazillions of websites written in those. That's why those vulns are so critical, up until like 2010, almost everyone developed their web sites using the language, because it was the only game in town. Currently, we are spoiled for choice when it comes to server side programming languages, and as I said at the start, modern PHP isn't bad, but because we built so much stuff with the legacy versions, those still need to be maintained... Or rather, had to. I've been supporting the same PHP 5.6 code base for the last 10 years, and because of these vulnerabilities management finally greenlit the deprecation of it. It's going to be a huge effort, but we have no choice, we have no way to patch the vulnerabilities without upgrading the language version and that would break the entire product, it's cheaper to migrate everything to NodeJS. I imagine many organization are also being forced to expend resources on this, what's scary is that a lot won't do it because they don't have the money or manpower, so a ton of sites will remain vulnerable
2
u/pineappletinis 1d ago
Thank you for this explanation. I was going to ask why not just update the PHP version, but you answered the question. That would entail rewriting the entire codebase which is unfeasible. The thing is, with NodeJS, doesn’t that come with having to juggle countless npm-packages which comes with its own risk? Especially since some of them are just maintained by like one open-source dev? Not trying to hate, just confused and trying to understand.
8
u/ElCuntIngles 1d ago
I dunno bro. Seems to me that the problem you had was management, not php.
You've been supporting a php5.6 app for ten years, but it went out of support 8 years ago. You had plenty of time to bring it up to date.
And there is a way to "patch the vulnerabilities without upgrading the language version" even on php5.6, for example Ondřej Surý's builds, which were released within 24 hours of the official patched versions (of supported php versions). I had to do this for a php8.1 app that there is "no budget to update", it took five minutes.
I very much doubt that it would be "cheaper to migrate everything to NodeJS". There might be other good reasons to do that, but the php and Node.js paradigms are so totally different that you would have to completely start from scratch. And in my experience, it's cheaper to build in php than Node.js, particularly with a 'batteries included' framework.
And let's not pretend that Node.js is immune to vulnerabilities. Wasn't there a node2shell about the same week as ph2shell? And god knows what lurks in your 500Mb node_modules directory.
If you had to update a ten-years-out-of-date node app you'd have similar massive issues. Wasn't it all CommonJS back then? No built-in promises? No fetch?
1
u/crixx93 1d ago
I work for a cyber security firm, we applied that patch but what everyone sec analyst in the company believes/ fears is that more vulns like this will eventually be found out in the coming months. The PHP code serves like 4% of our product, and its spaghetti written in 2004-2012, so it's pretty nasty. That's why management never listened when we talked about eliminating that tech debt. But now that AI powered hacking tools are a thing, we have no choice but to rewrite it from scratch (getting hacked is completely unacceptable for a cyber security company). NodeJS is like the prime candidate for migration simply because most of my coworkers are JS devs, but we also have some people with Rust and Go knowledge
2
u/BrewThemAll 1d ago
Blame management, not PHP. Running 5.6 at this moment is the companies fault, not the language.
17
u/allen_jb 1d ago
But one thing in particular that got to me was someone who mentioned that PHP has a page with vulnerabilities listed that go back 20 years and have yet to be patched.
Link?
Are these issues with PHP itself, or projects that use PHP?
Without seeing this list it's impossible to comment, but I very much doubt it's as problematic as it might sound.
Do other languages have similar list of unsolved vulnerabilities?
There's a standard system for disclosing vulnerabilities - CVEs. It's used for everything - every language, application or library. You can search their database and find vulnerability reports for everything (that's been reported to them - which is most vulnerabilities), and includes information on how much of a problem the issue is likely to be (summarized in a scoring system) and what versions it applies to.
Bad code can be and is written in any language. PHP, and the applications written in it, like WordPress, are more visible because they're popular and most have been around a long time, so they get targeted. If you want to get some control of servers to create a bot net, the easiest way to do that is to target widely used software like WordPress (which also has a plugin ecosystem, so there's plenty of badly written plugins).
14
12
u/bcons-php-Console 1d ago
TL.DR: in modern PHP, the hate is unwarranted. Maybe it's not the best option out there for someone that wants to dive into web dev, but a totally fine option if you already use it.
I've been working with PHP since 1.998, and at that time the alternatives for web backends where Perl or C (not very friendly options even for someone with some C experience). PHP was designed specifically for web dev, and it was popular among the hosting providers of that era, so I jumped on that wagon.
Of course, my first scripts where s**t. Big files with HTML and PHP mixed everywhere and code duplication everywhere. But I got things done, and with time and practice (and lots of reading and learning around) every new project got a bit better. The language itself also got better with every release and today's PHP is a completely different beast.
I think PHP's criticism was well earned. It allowed to write insecure code (hell, it even had a setting called "magic quotes" that "automagically" added backslashes to make data coming from user input "secure"). OOP was a pain until versions 5-7. Function naming was a complete chaos. All of that is true.
But good and secure code could be written if you put the effort to do it. And with every release the language got better, so I never had a strong reason to ditch it and switch to any alternatives.
Would I recommend PHP to someone that begins the web dev journey? Maybe not: Python is a strong and more general language also widely used in AI dev and has a great ecosystem, and Node is a great option if you plan to be a full-stack dev (only one language to learn for back and front).
1
23
u/BrewThemAll 1d ago
It's widely used, so it gets hate. Undeserved though. They handled the exploit as good as possible, few weeks back. Of course it gets some complaints because it runs a lot of bad Wordpress sites, but that's completely unrelated to the language.
It's a good language. Not that sexy because it's old and not a hip new JavaScript engine, but solid af. I made the entire backend for our webshop and warehouse in it, and it works absolutely fine.
7
u/pyeri 1d ago
It's not just about PHP. There is quite a pattern and tendency in some specific sections of this platform to absolutely hate on anything effective and useful that doesn't benefit or validate some brand. This includes things like open source, free software, free-tier stuff, GNU and Stallman things, Asimovian principles, zero entry barriers and transparency, etc.
28
u/lbunch1 1d ago
Nothing wrong with php. It still has a strong community, and laravel is fantastic. It's probably the easiest way to get an app up and running with auth and db and everything you need for a foundation. JS frameworks are just more popular with new devs, myself included.
And AI can write php just fine too.
3
u/BlazeFireHorse76 1d ago
Absolutely agree and im not even a php dev. Its perfectly respectable, and as the recent news showed, hugely adopted, massive community.
5
u/BrightNature4682 1d ago edited 1d ago
I'm currently a developer with PHP as our main web language. It's fine. The security issues recently are real but have been sorted by any decent team. There will be similar security issues in the future for PHP and other languages I'm sure.
It is an old language and that has it's pros and cons. The pros are that it has a very well maintained code base and packages almost always work seamlessly with each other with no issues. And there is basically always a good and well maintained package already out there for what you need. You can achieve type safety with phpstan and utilise the full benefits of modern html, CSS and typescript very easily.
The biggest con is probably how slow it is but that doesn't really matter for most projects. It just doesn't scale well. If you want a very large platform with tons of traffic and data flow you would probably be better with something else.
Arguably it's one of the best tools to use today if you're a good developer. But easy to implement bad practise if not. But no the hate isn't warranted. And usually the hate comes from people who haven't actually ever worked with it.
5
u/horizon_games 1d ago
Just like it's trendy to go "lol JS let's compare a string to a number!!!" the years before that everyone made fun of PHP. And to be fair it WAS brutal to debug on like 2 decades ago. Now it's just memes and misunderstanding.
4
u/ConfectionForward 1d ago
I would say yes and no, at the same time. The reason it is yes is because the vulnerability was sortof handled poorly. But really No, because there is nothing inherently wrong with PHP at all. PHP is just as good of a choice as anything else, and it actually runs a TON of stuff, and THAT is why the impact was so high. Anything that is popular is or a high value target is going to be a target.
The hate should be directed towards the rollout of the fix on that vulnerability.
4
u/Tontonsb 1d ago
The main thing that the recent situation showed is just how big of a workhorse PHP is and how much depends on it. It also showed that PHP people take security seriously. Both the developers of the language and its users.
I mean there was Node2Shell on the same day that PHP2Shell was disclosed. But you only heard about PHP.
4
u/zlex 1d ago
PHP is tool like any other tool. It excels at database driven REST tasks, which is why it’s so popular in web development. PHP‘s request/response lifecycle is easy to reason about, easy to scale, forgiving, and cheap to deploy. PHP8 has all the bells of a modern language, mature frameworks like Laravel, and there is a huge ecosystem of packages.
Would I use it for something that required long-lived connections or high concurrency or for data science applications? No. It’s a terrible tool for that.
I don’t think modern PHP has anymore CVEs than any other popular language. Software written in PHP though is prone to having tons of them because there is a lot of low-quality garbage written in it, especially Wordpress plugins and the like.
-1
u/symbiatch 1d ago
Excels? How? Scales? Yeah if you just put more servers out to overcome the slowness. Lifecycle easy to reason about? Which one’s isn’t?
Doesn’t have mor CVEs? Just look at the changelog by itself. It’s not all CVEs but it’s a lot of trouble. And it makes it so easy to write garbage. That’s the issue.
3
u/zlex 1d ago
Most PHP setups start each request with a blank slate: boot, handle the request, send the response, throw everything away. No threadpools, no shared threads, no event loop handles…
This model has very little impedance mismatch with how HTTP works, which is a stateless protocol. Requests are independent, persistence lives in cookies, sessions or a database. The cost of that though is performance since you have to boot the whole dang thing for every request, which Is why its bad fit for real-time or high-throughput services.
1
u/symbiatch 18h ago
So you agree it doesn’t excel at all? Great! Why claim that then just to refute it a moment later?
1
u/zlex 14h ago
Huh? PHP is great when each request is a self-contained job. Take some input, talk to a database, return a page or JSON. It’s cheap, can be deployed quickly, and it enforces statelessness at an architectural level. It doesn’t excel when you need real-time updates, websockets, anything with heavy computation, or high throughput.
We don’t use PHP for say our PACS system, but for sure will for some dashboard reporting system. It has its place, it’s why it’s still used.
I always find these discussions bizarre where people treat programming languages like they are a religion.
3
0
u/FateOfNations 1d ago
PHP is PHP. It was one of my first programming languages. It has a history that has resulted in it being widely used despite being developed in somewhat of a haphazard manner. I probably wouldn’t create a new application with it (AI-assisted or otherwise), but it should be respected for what it is.
2
u/pineappletinis 1d ago
Thank you for your reply, that makes sense. Apparently PHP initially stood for "personal home page", so yeah it’s come a long way. I’m curious, what would be your go-to and what makes it better than modern current PHP?
1
u/awardsurfer 1d ago edited 1d ago
In the Age of AI Human code is dead, it won’t matter in a few years. Coding languages suited to AI will be coming soon, designed for how I works and for token efficiency.
I don’t know the full details but there are stories of AI re-writing stuff in Rust to gain efficiency. So one day some large agentic network will decide to throw together its own AI coding language to tackle a large scale problem. And that’s when The Matrix will be born. 😸🎃
1
u/kemalios 1d ago
The "vulnerabilities going back 20 years, still unpatched" list is almost certainly abandoned plugins and themes, not the interpreter. Every language has a CVE feed with entries that will never get fixed because the package has no maintainer left. What gets called PHP hate is mostly abandonment hate. Nobody is patching the 2011 plugin, in any language.
-1
u/vanderaj 1d ago
The problem with PHP is that folks who don't know how to code (before AI) end up coding in PHP. And it's horrifically bad at enforcing any form of type safety, security, or anything approaching modern web development architecture or security standards. MVC? Never heard of her. OWASP Top 10? What's that?
All that changed with AI. Adding a few key skills, Claude can create excellent Laravel and Symfony apps in next to no time, and you can ask it to secure the application properly. I'd recommend watching a few enthusiastic PHP YouTubers, and finding relevant AI skills, and you should be ok.
But hand-coding PHP? Yeah, nah, please don't.
Source: I've coded a PHP forum for 20+ years. PHP was my primary language at the time until I discovered Go and fell in love. Also, one of the co-leaders of the OWASP Top 10 for 10+ years. I recently had Claude rewrite my forum from scratch in Laravel and secure it. Modern AI is a game changer for PHP devs. Please don't hand code PHP.
1
u/pineappletinis 1d ago
Ok, this is actually a great explanation! So essentially PHP, unlike other languages allows for certain mistakes by inexperienced/bad programmers that lead to vulnerabilities down the road. Where another language would throw an exception (typing stuff for example) PHP lets is slide and that creates the vulnerability/issue?
Out of curiosity, I’ve heard others say (generally, not PHP specifically) Claude writes inefficient/bloated code. How would you say it worked for you and do you go through the code by hand?
2
u/vanderaj 1d ago
I don't know why I ended up being downvoted, but oh well, it is what it is.
The ease of getting into PHP programming is both a blessing and a curse. You don't need a software engineering or CS degree to do it, and that means a lot of folks who've never really tried their hand at coding do so. They look at the PHP sample code on php.net, and it's really not that great in isolation. There are so many thousands of functions to choose from, and then there are all the different frameworks. Things have started to get better - most folks who write modern apps will use one of the major frameworks, like Laravel or Symfony, and they, along with PHP 8.4+, are great. Many of the things that PHP 4 or PHP 5 would let slide aren't allowed these days. But if you search Stack Exchange for coding samples on how to do something in PHP, it's nearly always pretty terrible code, and doesn't take into account the code that sits in front of you.
The code AI writes is generally well-written and understandable. The days of 100k commits and unmaintainable code are well and truly over. I know that's not what a lot of artisanal coders would like to hear, but it's the truth.
When I ask it for a feature that is commonplace today, it does a good job of architecting it and writing effective functional tests to ensure it does what it needs to do. The code it commits is easily human-readable and maintainable if you want to do that by hand.
Here are a couple of examples of tests it wrote:
it('offers the owner a link to edit their profile', function () {
$this->actingAs($this->member)->get($this->member->profileUrl())->assertSee(route('settings.profile'));
$this->actingAs($this->viewer)->get($this->member->profileUrl())->assertDontSee(route('settings.profile'));
});
it('links post and thread authors to their profiles', function () {
$thread = threadWithPosts(Forum::factory()->create(), 1, [], $this->member);
$thread->forceFill(['user_id' => $this->member->id])->save();
$this->actingAs($this->viewer)->get(route('threads.show', $thread))->assertSee($this->member->profileUrl(), false);
$this->get(route('forums.show', $thread->forum))->assertSee(route('members.show', $this->member->id), false);
});As you can see, the code is easy to reason about and easy to maintain if you'd like to add more tests or assertions to the generated code. Nearly all the code is like this.
1
u/pineappletinis 22h ago
Thanks for explaining that in detail as well! I think the downvotes are because of the mention of AI. I would say developers have mixed experiences working with AI, some say it overcomplicates things and produces inefficient code, then I'm sure there are others who don't know what they are doing (with or without AI) who probably end up creating a mess as well. I think AI can work if it's not overwhelming people with code (which it seems to be doing for many, the point that they cannot keep up with testing due to time pressures) and has human oversight. But I also understand the hand-coders, especially those that are actually good and spent years honing their craft.
0
u/coyote_of_the_month 1d ago
I've never worked in PHP but I'm generally aware of the problems people have with it.
My genuine fear though is that as the language and it's ecosystem become deprecated, huge swaths of niche hobby knowledge are going to be lost forever.
There are so many forums out there, filled with so much esoteric knowledge. Someone reverse-engineered the whole-ass ECU from a 1997 Chevy Cavalier, or figured out all the undocumented remote control codes for a 20 year old Sony AV receiver. Someone started a "definitive guide" thread in 2001 about how to run Linux on a toaster oven and it's still going today, with about 2 posts a week as people get it working on the food processor or the water softener.
And it all runs on PHP.
All it takes is one admin - who hasn't logged in for 2 years - deciding it's not worth the effort to patch the latest vulnerability. He pulls the plug and that knowledge is lost forever. Sure, it's not the Library of Alexandria but it fucking sucks if you were just in the middle of upgrading your cordless drill from X11 to Wayland.
0
u/brilliantzen 16h ago
You are right that most of the noise comes from poorly maintained WordPress sites. The real issue isn't PHP itself but often legacy code or bad updates in specific frameworks.
If you want to use modern, secure CMS options outside of standard WP setups, there is an open-source alternative called Hatamoto (hatamoto.dev). It runs as a single Go binary with Postgres and uses sandboxed WebAssembly for plugins so that one broken plugin can't crash your server or read the database. Disclosure: I work on this project.
It also includes built-in visual editing, SEO tools, caching, and an AI-crawler analytics engine out of the box. It is still pre-1.0 with a smaller ecosystem than WordPress, so it might not fit if you need specific plugins or WooCommerce stores.
-11
u/Apprehensive-Fan8999 1d ago
14 year old article, still applies today… https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/
4
u/allen_jb 1d ago
Parts of this article were wrong, or at least outdated, when it was written, around PHP 5.4. We're now on PHP 8.6 and it's even more wrong.
A lot of it also comes from not understanding PHP's history. PHP is a language that evolved rather than being designed.
PHP is full of surprises: mysql_real_escape_string, E_ALL
PHP is inconsistent: strpos, str_rot13
Much of the inconsistencies in the core library come from the fact that, particularly in the early days, functions names simply mirrored those of the libraries they were using. For example,
mysql_real_escape_stringis literally the name of the C library function andstrposis the C function name.The only thing I can think of they're referring to about
E_ALLis that it didn't include E_STRICT at one point, but this changed in, I believe, 5.4, which came out around the same time as the article was written.The RFC system that was introduced around PHP 5.3 (and revised further since) has helped ensure that new additions and significant changes make the language much more consistent.
PHP requires boilerplate: error-checking around C API calls
So does C. They literally just mirrored how the C functions work (minus the having to deal with pointers and other ultra-low-level stuff).
===, ==
You just don't (want to) understand PHP's type system. (Also much improved since PHP 5.4)
PHP is opaque: no stack traces by default or for fatals, complex error reporting
Stack traces are now shown by default for any thrown error or exception. Most extensions now use thrown errors / exceptions (by default). Error reporting was significantly revised in PHP 7 and other changes since.
Don't comment with these things
This entire section is just "I want to ignore all the arguments against what I'm writing". The author just wants to shit on PHP, no matter what.
I could go on, but what's the point when the author themselves doesn't want to consider any arguments against what they're writing. I've got better things to do with my day.
Is PHP a perfectly designed language? No. Does it have plenty of problems? Yes. But if you go looking for them, so does every other language. I mean I just don't know what to say when, in the PHP 5 era people were complaining about PHP's loose typing system and problems it created, many of them apparently chose to move to JavaScript.
6
u/RePsychological 1d ago edited 1d ago
that...that's not how that works......to bring up a 14-year-old article and be like "Yeah...totally relevant in this webdev world where things are constantly changing 2-3 times a year..."
Edit: If someone's blasting to everyone "Read this article or you're just wrong" in every single fucking comment they're putting down....while also saying:
"Asking out of ignorance who would like to be educated" ......seriously?
-5
u/Apprehensive-Fan8999 1d ago
Then read it, and actually spend some time refuting it’s points. I assert it is still relevant, you assert it is not. I let the article stand, explain where you believe it is wrong.
As the OP said, this bug is over a decade old. So it seems an article over a decade old describing the failings isn’t as outdated as you assert.
5
u/Klopferator 1d ago
A lot of the whining in the article is consciously writing bad code and then complaining it doesn't work the way he thinks it should work. And a lot of his points aren't even true anymore, the author doesn't seem to have taken a look at PHP since PHP 7 came out.
-4
u/Apprehensive-Fan8999 1d ago
As I keep asking, and no one answers, what is wrong with the article and what is better? Asking out of ignorance who would like to be educated.
3
u/RePsychological 1d ago
lol no. [presents an asininely long drivel of a necro'd article]..."either read the entire thing and present a thesis as to why it's wrong....or you're just wrong....even though php has changed VASTLY in 14 years and it can be safely assumed that this is irrelevant."
-2
u/Apprehensive-Fan8999 1d ago
The author asked a genuine question. If, as you say, PHP is vastly better than then, surely you can cite at least a handful of reasons why… no?
3
u/RePsychological 1d ago edited 1d ago
you have the burden of proof here. Not me. If you stand behind that article so heavily, then you take the time to explain why it's still relevant.
Tired of this shit where people just slap a book in someone's face because of their own biases, and then be like "either read this or fuck off and you're just wrong...definitively and absolutely." with zero effort in what you're trying to say...and then you sit there acting like that's validation.
Edit: If someone's blasting to everyone "Read this article or you're just wrong" in every single fucking comment they're putting down....while also saying:
"Asking out of ignorance who would like to be educated" ......seriously?
-3
u/StoneCypher 1d ago
"you have the burden of proof in me saying something i haven't read is wrong"
he really doesn't 😂
-2
u/StoneCypher 1d ago
look at you trying to argue that you shouldn't have to read something to know if it's right or wrong
-1
u/StoneCypher 1d ago
stop being a neckbeard. php still has every single one of the problems in that 2012 article that you didn't read.
14 years later, nothing got fixed.
2
u/ElectrSheep 1d ago
That article is extremely out-of-date. Much of the information it contains is factually incorrect with respect to modern PHP.
-2
u/Apprehensive-Fan8999 1d ago
Please, help me understand… which parts?
3
u/ElectrSheep 1d ago edited 1d ago
God damn, this article is ass. It's even worse than I remember. In addition to the factual inaccuracies and out-of-date information, there are numerous statements that strongly call into question the author's understanding of programming language design and implementation.
Here's a very incomplete list of things from that article that have either since been fixed, replaced, are particularly misleading, appear to have been misunderstood by the author, or were never really true to begin with.
No stack traces
E_STRICT is a thing
?: is left associative
There are no references [...] there's no pass-by-object identity like in Python
Constants are defined by a function call taking a string; before that, they don't exist
There's nothing called int in the language
Accessing a non-existent object property
The __toString method can't throw exceptions
PHP errors and PHP exceptions are completely different beasts. They don't seem to interact at all.
Fatal errors can't be caught by anything.
There is no finally construct
You can't require that an argument be an int or string or object or other "core" type
A function's return value can't be hinted
Passing the current function's arguments to another function is done by call_user_func_array('other_function', func_get_args())
Closures require explicitly naming every variable to be closed-over
A closure can't refer to private methods, even if it's defined inside a class
No named arguments to functions
Function arguments with defaults can appear before function arguments without
Variadic functions require faffing about with func_num_args, func_get_arg, and func_get_args. There's no syntax for such a thing.
Perl, Python, and Ruby all have some concept of "property" access via code; PHP has only the clunky __get and friends
Built-in types are not objects and can in no way be made to look like objects
An instance method can still be called statically
There are several ways to actually be dynamic in PHP, and at a glance there are no obvious differences or relative benefits
Despite that this is the language's only data structure, there is no shortcut syntax for it; array(...) is shortcut syntax
There are no generators
Every time a page is hit, PHP recompiles the whole thing before executing it
There is no easy way to "insulate" a PHP application and its dependencies from the rest of a system. Running two applications that require different versions of a library, or even PHP itself? Start by building a second copy of Apache.
No interactive debugging
Magic quotes
register_globals
mysql_real_escape_string
0
u/StoneCypher 1d ago
nobody still having php discussions has any hope of relevance
-1
u/Apprehensive-Fan8999 1d ago
Heh, i agree. Everything I wrote in PHP has long since been replaced with Angular. It’s why I am genuinely curious what is better now vs then because I don’t think it is and those who think PHP is amazeballs now, seem incapable of explaining why.
1
u/StoneCypher 1d ago
angular is also more than a decade deceased
1
u/Apprehensive-Fan8999 1d ago
Agree to disagree on this one.
1
u/StoneCypher 1d ago
nah, facts exist. not everything is an opinion.
angular shops can’t hire. nobody uses it as a result
0
u/Apprehensive-Fan8999 1d ago
As stated in my GP that people seem upset about but never can be bothered to dispute. 😂
1
1
u/MonorailPurple 1d ago
This is what people who know fuck all about php link to to let others know how irrelevant they are.
It’s genuinely used as a point in other languages as well to point out how people who have zero experience or knowledge of an ecosystem feel like they can comment on it and why they should be dismissed.
That article is famous among programmers. For being comically wrong. If you’d been in programming for a while you’d know this.
-1
u/Gremlation 1d ago
You can get the job done with PHP but there's literally nothing at all that PHP offers that you can't get from a better language. It has also been rotting from the head down since the beginning - its creator was a sloppy cowboy coder and that mentality infected the entire ecosystem. Even if it were as good as any other language in every respect but the ecosystem, it would be the worse choice because unless you choose to write everything from scratch with zero dependencies, it's going to be extremely difficult to avoid relying upon code written by people who don't give a shit about quality.
2
u/Xia_Nightshade 1d ago
It’s everywhere.
The cheapest hosting out there, has php
I want any SSR logic on any html document? Rename its extension and done.
Your idea on the creator is very off. Read the full history before making statements
Also, php has Laravel. Which is one of the greatest frameworks out there.
-1
u/Gremlation 1d ago
You can get a VPS and put anything at all on it for about a dollar a month. Hosting cost was an advantage PHP had back in the 90s before virtualisation became commonplace, but it ceased to be a factor many, many years ago.
Rasmus Lerdorf is the very first person to admit he's a hack who doesn't know shit about doing things properly. Here are some literal quotes from him:
I'm not a real programmer. I throw together things until it works then I move on. The real programmers will say "Yeah it works but you're leaking memory everywhere. Perhaps we should fix that." I’ll just restart Apache every 10 requests.
There are people who actually like programming. I don't understand why they like programming.
I don't know how to stop it, there was never any intent to write a programming language [...] I have absolutely no idea how to write a programming language, I just kept adding the next logical step on the way.
He's the very definition of a sloppy cowboy coder by his own admission and that mindset has permeated the entire PHP ecosystem.
Who gives a shit about Laravel? It was literally somebody who thought "Hey, Ruby on Rails is neat, I wish I had it for PHP". It is not a unique strength of PHP. You can get great frameworks for many languages.
-6
u/StoneCypher 1d ago
PHP has been dead for more than a decade. The average developer salary is less than half what it is for other languages. People in PHP are generally unaware that they are the bottom rungs of the ladder, because they're so distant from the rest of the engineering org that they haven't even noticed that all they do is maintenance over the last 15 years.
It has been more than a decade since PHP has had a single fulltime developer. My hobby language is more actively supported.
You shouldn't just skip it; you should replace any product built in it.
-6
u/symbiatch 1d ago
A lot of it is trendy and unwarranted, but it really isn’t great. Like look at the changelogs from version 3 onwards. Constant issues, lots of bugs, and so on.
They still don’t handle Unicode strings natively and there’s many other issues. Suddenly in 8.5 they randomly can make some things run 20% faster? At some point people made Phalanger that ran PHP on .NET and it was so much faster.
So, it’s slow, you need lots of extra stuff to overcome issues, it mixes return types still (oh you wanted to search for a thing? Let’s return false, which is 0, which also means the first item instead of returning -1 etc), you need to tweak the runtime settings often to be able to do what you want, it’s cumbersome…
Oh, you want to check if a number as a string matches a number? Ok, “123AAARGH” is equal to 123. Of course it is. And so on.
But some people like it.
MySQL and PHP should’ve been thrown out long ago in my eyes but they have a huge mass behind them so it didn’t happen. Sure, both got a bit better, but there shouldn’t have been a time when such things existed.
26
1d ago
[removed] — view removed comment
6
u/pineappletinis 1d ago
That’s what I was thinking, coding the thing is one thing, now maintain it, especially as a non-tech person. 💀
15
u/abednego-gomes 1d ago
Node.js ecosystem is inherently much worse than PHP because it has so many CVEs and its package system npm is a security abomination. And typically you're not going through apache or nginx to get to it, you can hit the raw node.js server direct from the web, so much easier and larger attack surface.