I still love PHP. 23 years ago we created some encryption software for it and it is still going. I also run a PHP newsletter. There's still a strong community of people and whilst there are other languages which I also use (Python, Node.js) I still find myself gravitating towards PHP for fast and simple work
The only issues I have. is that this is a 'double edged sword' in that PHP has become far more complex since the launch of PHP 5 and so it isn't as easy to understand from scratch as it used to be
PHP is a perfect example of how to undergo major transitions correctly.
In the time that it took Python to go from Python 2 to 3, PHP underwent 5.2 -> 5.3 and 5.6 -> 7.0. 5.3 changed how you write PHP in a fundamental way by introducing namespaces and PSR0 autoloading. Then, 5.6 -> 7.0 cleaned up the parser, resulting in massive speed improvements.
They did this by not breaking the universe in these major updates...or really, any of there updates. Each update would break a few specific things, warn you about a few other things that were going to break in the near future, while giving you ways to shim the old behavior if you _really_ needed it.
They also gave you ample carrots reasons to update - aside from what was already mentioned, my personal favorite update was PHP 5.4 because it introduced short array syntax, made UTF-8 the default charset, introduced traits, and finally put register globals and magic quotes out of their misery...but giving you a shim if you had some ancient project that needed it.
If you're wondering why PHP 6 was abandoned, it was because it was an update in the style of Python 3 by breaking strings everywhere. In retrospect, I think the decision to cancel 6 was the right one. Somehow, I doubt that PHP would've had the influx of data science and AI that saved Python 3.
Hats off to the project - I've long been off of the CGI-style web development narcotic, but the language put food on my table for quite some time, and the people steering the language treated their community well.
I've seen a few other comments also talk about PHP becoming more complex. However, I have "simple" code built using 5.3 and it works perfectly fine in 8. So I guess it CAN be complex, but doesn't really need to be. The biggest changes I would make to that code are fixing the multiple 'switch' and 'if/else' blocks to an anonymous function or some mapping... but it's not required.
I think PHP 8 is easy to understand if you write it from scratch, you just have to learn doing things the right way, read up on PSRs and so on. It is a bit more complex but much more secure and supports quite a lot of things now that are definitely helpful to have.
PHP's evolution since PHP 5 has been substantial, and I think this is a real problem. As someone who learned the language years ago, the pace of change (generics, attributes, match expressions, typed properties) makes modern codebases genuinely difficult to follow.
I suspect this affects many developers who cut their teeth on PHP but haven't kept up. The language has become a different beast, which is a strength for the community but a barrier to re-entry.
IMO, newer PHP is still very readable. I programmed with C++ for a decade, but I can safely say that I cannot understand a modern C++ code base anymore.
It's a real problem with almost all software today, nothing ever gets done. they just keep piling unto it no matter how great it was. the idea of simplicity as a goal and feature is lost on this generation.
I dunno; I started with PHP 5 (actually, I think I started in late PHP 4), and I've only been happy with the changes as it's evolved.
The only one that's caused me any significant stress is the deprecation of the old `mysql` DB interface; I had to refactor a whole bunch of code for that, since I'm maintaining a codebase that's been in continuous use & development since 2001.
The additions to PHP since 5 add more things you can do, but they don't really change the simple things you can do to first learn PHP. You can still just create a .php file and start interspersing HTML and <?php script tags with basic operations.
To be fair, that’s true of many languages and programming domains. The web, in particular, is one where you have to keep pace or end up out of the field.
Java and C# are a couple other popular languages where the same is also true.
Most likely this can be said about a lot of languages, most languages are being maintained and improved. I am an hired expert in Java and I needed to explain some new languages features to some colleagues that have been introduced recently, I only mention them if they actually improve readability though.
I think PHP might be slightly different than other languages as a huge amount of people use this to create their first website as a hobby.
You can still write php 5-esque slop and have it run... mostly (some particulars like the half dozen ways of interpolating a variable into a string have been paired down, some extensions left in the dustbin, but the fundamental "shit out a script and run it" capability still remains doable).
non of the "modern" things are particularly taxing to teach someone with more than two braincells. If they don't understand them then they haven't kept up with ANY programming trends in the past decade and are best placed infront of the TV with an iPad than left to mess with the possible critical infrastructure of a business.
A lot of people are too proud to be associated with PHP. I am ready to admit that know nothing about the language except that a lot of people make cool things with it.
My favourite PHP product at the moment is BookStack (https://www.bookstackapp.com/), a really good wiki. I run an instance for my family and it's great.
But there are loads of things. And I notice that many of the sites I like using...are built on well maintained PHP stacks.
Modern PHP is a damn fine, fast language. I wrote production PHP from 2021 to 2023. The problem with PHP wasn't the language or the ecosystem (PHP community packages are very solid in my experience), it's the existing PHP code you'll work with and the people that hire for PHP.
My salary literally doubled within two years of getting a gig that wasn't PHP. If you see a listing for PHP dev work, there's a good chance it's notably lower salary. There are still solid gigs for it, but I swear they lean lower.
The other problem is the existing codebases. There is some awful legacy PHP 4 era code. There are also a lot of practices that old PHP had that are just awful to work with, and there's a bit of variety in there. So many bad data access patterns out there. Many of old PHP codebases have their own spin on that kind of thing.
I understand this isn't actually due to the language, but there is a real correlation (in my experience) between old bad code and it being in PHP. Which is totally fair because it was a good tool to reach for to "get shit done (r)" and that code was successful enough to have to continue to live.
Modern PHP has, thanks to the core language and the big frameworks, made it wonderful. I lead a big push to go from PHP 5.8 to PHP 8.1 at the time at my last company. It was wonderful. The quality of the code we were enabled to write was huge.
If I was starting a new project today, I probably wouldn't reach for PHP, but I'd gladly join in on a modern (last ten years) Laravel project.
PHP is a very pleasant and straight-forward language to work with. I enjoyed my time working with it, though I did also see quite a lot of very poor code.
I think the danger with PHP is more its ability to easily cause *very bad things*.
This would partially be poor training (my University literally taught PHP with SQL-injectable examples), and I think the language itself making it very easy, such that less-experienced developers using it - most of them, early on - don't realise what's wrong until it's gone wrong.
With PHP being such an early tool online, and the above properties existing, it earned a reputation for being insecure and bad.
I'd take PHP instead of JS/TS + framework-of-the-day on the backend anytime. Ok, PHP is usually also paired with a framework (cough Laravel cough), but at least there the situation is more stable, not to mention more mature. Unfortunately, I'm not the only one making the decisions...
A lot of C# and Java code is oriented towards web backends, too. Which are quite big and complex. So it seems natural that languages in the same design space (trad OO) converge on similar features. I think the only exception these days is Go.
I think these days you could change "You can write Fortran in any language" to "You can structure your code like Spring in any language"…
Still, even if it was "just" the web, why wouldn't it evolve? It's a great language, with a big user base, and there's always room for improvements and to increase the developer experience
I downvoted you before reading the fine article. I'm back to correct that.
The new array_first() and array_last() functions are nice, everything else is either reimplantation of existing features or "features"which will make maintainability more difficult. The pipe operator is one such example. I don't need it - these nested methods are not really an issue in any codebase I've seen. The new syntax only works for unary functions, so higher arity functions must be wrapped in an arrow function. It's a mess and more bug prone than just nesting the functions.
That is an anti-pattern, since it suffers from shell meta-character injection (and argument injection). Since PHP has mkdir, you should use that instead. And pcntl_exec() is the correct API for running processes.
Parse_url isn't standards compliant, often fails with relative url's and most importantly only parses urls, not uris (with the exception of file://). I also find it's syntax clunkier than the new uri(), but that's just personal preference.
The pipe operator is indeed just syntactical sugar (and the article links to another article specifically about it which does cover the case of temporary variables), but with the coming partial function application feature it (in my opinion) will make easier to read/reason chains of code than temporary variables or nested function calls.
Adding new functions and alternative syntax has a long-term cost for PHP and the projects that use the language. I don't see much value in the new features of PHP5 announced on https://www.php.net/releases/8.5/en.php
- URI extension: there was already the internal `parse_url()` which was imperfect, and alternative libraries that were RFC 3986 compliant. An official extension will bring speed, but now there will be 2 official ways to parse URLs.
- The pipe operator is a matter of taste. In the release notes, the new code is more verbose, because it defines anonymous functions. This alternative syntax means keeping a consistent code style will be harder.
- The update of "clone" replaces 2 lines of code in some cases. Unless I misunderstood, it's a very minor change.
- The #Discard/void will replace the similar feature from static analyzers.
- Closures in constants is one of the 2 features that bring more than an alternative syntax. It's one more little step toward a preprocessor. But I'm not thrilled about the future #attributes assigned with complex closures.
- cURL persistent handles are a real performance feature, because curl_init() is costly.
- array_first() is a minor syntax-sugar. In a project of 100k+ lines of PHP, I probably could use it twice or thrice. Was it worth a global function?
PHP should REALLY focus on getting the core stuff in shape.
Its still so annoying that you have to use mb_real_uppercase($name) for unicode. The other gripe is that the stdlib is SO messy. With PHP 5.3 they had a once in a lifetime opportunity to cleanup the stdlib and introduce a new namespaced API for builtins, and optionally introduce a uniform function call syntax:
"foo"->strtoupper();
Whenever doing PHP the time for concurrency will come sooner or later. Having no way of doing ANY concurrency is a letdown. The Fiber API does nothing on its own, and you are forced to use some third party runtime, that is usually a non-starter for legacy projects.
PHP has come a long way from the PHP 4.0 era, but is still lacking in multiple areas, and i dont see it being a pick for greenfield projects in 2025.
As for concurrency/async, it's possible to do requests in parallel with curl_multi_*. Other async/prallel things are also possible, but tend to be more complicated compared to JS or other languages with promise and async support.
Your second option was rejected years ago I believe. The pipes were designed to work alongside this rfc that was supposed to be in this new version (8.5) but due to time constraints it had to be delayed and it’s currently being voted https://wiki.php.net/rfc/partial_function_application_v2
if they was something to learn it was for the Ruby community to learn from the PHP community on how to reinvent itself.
PHP like Ruby had some big companies built on it - Facebook: PHP, Ruby: Github/Shopify
PHP was able to swallow Hack and become PHP8 - they optimized for getting beginners into the language / ecosystem
Ruby while a beautiful / friendly language and ecosystem - got into political wars - didn't optimize for beginners on windows etc
even as a person who favors Rails - Laravel is ahead -> on documentation & bringing various ways to do things into the framework. There's no stick with Hotwire. You wanna do livewire go ahead, we will help you. You wanna do Inertia + JS - go ahead we will help you.
One of the things I have noticed in languages is that after some iterative evolution the piled on features and syntaxis sugar make them look bizarre and hard to read. Probably the weight of backwards compatibility and that the initial paradigms have picked up the easy to understand real estate. And there are no good ways of getting out of the corner you have coded yourself in.
Probably because compile/interpret is one way street. There is no way to lets say view/transform a part of the code in functional or imperative depending on what you need to do with it.
Reading modern php or even worse mixed generations code base feels like another full time job on top of the regular one - coding with it.
Why is it that all these languages like PHP, but also typescript are becoming like impossible puzzles to read. I find these generics, types and other language features very often causing complex software architecture. I see so many collegues these days struggling in understanding codebases. You almost need a PHD brain to be a frontend web developer.
I assume it is some inferiority complex, on many sides. PHP itself was laughed at being too simple, underpowered and inconsistent, now they overcorrected with types, annotations and breaking backwards compatibility with every release so that no old code base can remain intact. Frontend devs yearned to be regarded as real developers, which in their context means construction of unwieldly and overcomplex enterprise bullshit, thus typescript etc. And in the backend you have that same mechanism, devs having to prove they are no beginners and thus using (wrongly) design patterns, instructed by software architects, instead of avoiding abstraction and thus complexity.
Can you share an example of what you're talking about in PHP 8.5? On the linked web page, the only code pattern that looks remotely complicated to me is the following:
#[SkipDiscovery(static function (Container $container): bool {
return ! $container->get(Application::class) instanceof ConsoleApplication;
})]
final class BlogPostEventHandlers
{ /\* … \*/ }
Is PHP still unhelpful when it comes to writing secure code?
I remember when escaping SQL input data was "the correct way" to use your mysql database. Parametrization? Nah, just use mysql_escape_string or whatever it was called.
php has kept around a lot of functionality that can be misused, but PDO has had parameterization since forever and is the go to method if you want to connect to a database. Beyond that though, most PHP projects at this point are likely using a query builder/orm like eloquent.
So I guess it depends on what you mean by unhelpful. PHP as a language makes it pretty easy to do bad stuff. PHP as a community makes it easy to Do The Right Thing.
Prepared statements have been available in PHP for over 20 years, when it deprecated the old mysql libraries. They were removed entirely in PHP 7.
And let's be real - most handwritten SQL code in existence in most languages just builds queries from concatenated strings, even when more secure options exist. A lot of code doesn't even bother to escape anything. That's not a language problem so much as a developer laziness and assumption that "simplicity always equals correctness and frameworks are always wrong" problem.
I remember the discussions at the time about which filename extension to use - and I can not believe that .php3 won. I think that I was the first to bring up the subject for PHP 4, to use .php again and not include the version number.
What do you mean developers should deal with functions like those? They're used when necessary, yes, just like any function. And no IDE is required. I'm really puzzled.
Such a change makes it a completely different language with no compatibility. Thus all previous code is lost, no easy migration paths (especially for libraries which would like to support both during transition)
I think php should have stopped at php4 or php5 and maybe just develop a new/sane standard library.
And a new language could have been developed , call it hack or whatever Facebook tried. Anyway I remember php coding gave me headaches. Tried it again 2 years ago and found out the same kind of issues(outdated /inexistent documentation, different ways to do the same thing that actually didn’t work and stuff like that). Try to connect to sql database using ssl and see what I mean.
I see no reason to learn PHP anymore or start up your company using php.
We live in a vps/docker age. The advantage of php hosts everywhere has been lost.
Without specifics it's hard to understand what kind of difficulties you had.
But PHP is still so strong because it offers much more than "easy hosting".
What I personaly love most is the instant save file->see results feedback loop. There's no perceptible compilation step. Meanwhile my Java project takes a minute to compile.
Also the shared-nothing model by default is powerful and rare.
Laravel is probably the most well documented frameworks even comparing frameworks from other languages. And symfony, also a PHP framework, is not far from that.
When you say "SSL" I can only think your reasoning is based on outdated information since no one calls it SSL anymore. It's TLS for some years now. And I have been connecting to databases using PHP TLS/SSL since version 5. For almost a decade now.
inovica|3 months ago
The only issues I have. is that this is a 'double edged sword' in that PHP has become far more complex since the launch of PHP 5 and so it isn't as easy to understand from scratch as it used to be
LexiMax|3 months ago
In the time that it took Python to go from Python 2 to 3, PHP underwent 5.2 -> 5.3 and 5.6 -> 7.0. 5.3 changed how you write PHP in a fundamental way by introducing namespaces and PSR0 autoloading. Then, 5.6 -> 7.0 cleaned up the parser, resulting in massive speed improvements.
They did this by not breaking the universe in these major updates...or really, any of there updates. Each update would break a few specific things, warn you about a few other things that were going to break in the near future, while giving you ways to shim the old behavior if you _really_ needed it.
They also gave you ample carrots reasons to update - aside from what was already mentioned, my personal favorite update was PHP 5.4 because it introduced short array syntax, made UTF-8 the default charset, introduced traits, and finally put register globals and magic quotes out of their misery...but giving you a shim if you had some ancient project that needed it.
If you're wondering why PHP 6 was abandoned, it was because it was an update in the style of Python 3 by breaking strings everywhere. In retrospect, I think the decision to cancel 6 was the right one. Somehow, I doubt that PHP would've had the influx of data science and AI that saved Python 3.
Hats off to the project - I've long been off of the CGI-style web development narcotic, but the language put food on my table for quite some time, and the people steering the language treated their community well.
matula|3 months ago
dijit|3 months ago
ZEND?
I remember "nulling" software in the mid-00's and Zend was always a terrible ball-ache.
Which, if that was your project, is high praise. :)
johnisgood|3 months ago
darkamaul|3 months ago
I suspect this affects many developers who cut their teeth on PHP but haven't kept up. The language has become a different beast, which is a strength for the community but a barrier to re-entry.
gramakri2|3 months ago
johnisgood|3 months ago
segmondy|3 months ago
danaris|3 months ago
The only one that's caused me any significant stress is the deprecation of the old `mysql` DB interface; I had to refactor a whole bunch of code for that, since I'm maintaining a codebase that's been in continuous use & development since 2001.
The additions to PHP since 5 add more things you can do, but they don't really change the simple things you can do to first learn PHP. You can still just create a .php file and start interspersing HTML and <?php script tags with basic operations.
woodrowbarlow|3 months ago
jm4|3 months ago
Java and C# are a couple other popular languages where the same is also true.
ivolimmen|3 months ago
pjmlp|3 months ago
Capricorn2481|3 months ago
But PHP 5 was released 21 years ago and is unsupported. Companies using it are putting their customers at risk.
_DeadFred_|3 months ago
tehbeard|3 months ago
non of the "modern" things are particularly taxing to teach someone with more than two braincells. If they don't understand them then they haven't kept up with ANY programming trends in the past decade and are best placed infront of the TV with an iPad than left to mess with the possible critical infrastructure of a business.
phplovesong|3 months ago
calpaterson|3 months ago
My favourite PHP product at the moment is BookStack (https://www.bookstackapp.com/), a really good wiki. I run an instance for my family and it's great.
But there are loads of things. And I notice that many of the sites I like using...are built on well maintained PHP stacks.
jjice|3 months ago
My salary literally doubled within two years of getting a gig that wasn't PHP. If you see a listing for PHP dev work, there's a good chance it's notably lower salary. There are still solid gigs for it, but I swear they lean lower.
The other problem is the existing codebases. There is some awful legacy PHP 4 era code. There are also a lot of practices that old PHP had that are just awful to work with, and there's a bit of variety in there. So many bad data access patterns out there. Many of old PHP codebases have their own spin on that kind of thing.
I understand this isn't actually due to the language, but there is a real correlation (in my experience) between old bad code and it being in PHP. Which is totally fair because it was a good tool to reach for to "get shit done (r)" and that code was successful enough to have to continue to live.
Modern PHP has, thanks to the core language and the big frameworks, made it wonderful. I lead a big push to go from PHP 5.8 to PHP 8.1 at the time at my last company. It was wonderful. The quality of the code we were enabled to write was huge.
If I was starting a new project today, I probably wouldn't reach for PHP, but I'd gladly join in on a modern (last ten years) Laravel project.
nusl|3 months ago
I think the danger with PHP is more its ability to easily cause *very bad things*.
This would partially be poor training (my University literally taught PHP with SQL-injectable examples), and I think the language itself making it very easy, such that less-experienced developers using it - most of them, early on - don't realise what's wrong until it's gone wrong.
With PHP being such an early tool online, and the above properties existing, it earned a reputation for being insecure and bad.
rob74|3 months ago
etothet|3 months ago
Coding in PHP can be a lot like playing the guitar or writing poetry: many people can do it, but it’s easy to do very badly.
ThatMedicIsASpy|3 months ago
AzuraCast because I like learning by looking at code and hosting my own radio/music
nake89|3 months ago
How so?
bawolff|3 months ago
Another wiki that uses php is Wikipedia.
People like to shit on php but it powers some of the largest sites in the world.
At the end of the day, programming language doesn't matter much. You can be a good programmer in any language and a bad programmer in any language.
dalemhurley|3 months ago
f311a|3 months ago
mhd|3 months ago
I think these days you could change "You can write Fortran in any language" to "You can structure your code like Spring in any language"…
Xenoamorphous|3 months ago
nunodonato|3 months ago
Still, even if it was "just" the web, why wouldn't it evolve? It's a great language, with a big user base, and there's always room for improvements and to increase the developer experience
dotancohen|3 months ago
The new array_first() and array_last() functions are nice, everything else is either reimplantation of existing features or "features"which will make maintainability more difficult. The pipe operator is one such example. I don't need it - these nested methods are not really an issue in any codebase I've seen. The new syntax only works for unary functions, so higher arity functions must be wrapped in an arrow function. It's a mess and more bug prone than just nesting the functions.
theoldgreybeard|3 months ago
neor|3 months ago
Most of the time if I want the first or last element I don't care about the array itself so array_shift and array_pop work just fine.
habibur|3 months ago
like in `mkdir $dirname`;
pabs3|3 months ago
petecooper|3 months ago
dgb23|3 months ago
The url parse example is not being compared to the builtin parse_url function that is just as easy to use.
RobAley|3 months ago
The pipe operator is indeed just syntactical sugar (and the article links to another article specifically about it which does cover the case of temporary variables), but with the coming partial function application feature it (in my opinion) will make easier to read/reason chains of code than temporary variables or nested function calls.
idoubtit|3 months ago
- URI extension: there was already the internal `parse_url()` which was imperfect, and alternative libraries that were RFC 3986 compliant. An official extension will bring speed, but now there will be 2 official ways to parse URLs.
- The pipe operator is a matter of taste. In the release notes, the new code is more verbose, because it defines anonymous functions. This alternative syntax means keeping a consistent code style will be harder.
- The update of "clone" replaces 2 lines of code in some cases. Unless I misunderstood, it's a very minor change.
- The #Discard/void will replace the similar feature from static analyzers.
- Closures in constants is one of the 2 features that bring more than an alternative syntax. It's one more little step toward a preprocessor. But I'm not thrilled about the future #attributes assigned with complex closures.
- cURL persistent handles are a real performance feature, because curl_init() is costly.
- array_first() is a minor syntax-sugar. In a project of 100k+ lines of PHP, I probably could use it twice or thrice. Was it worth a global function?
boxedemp|3 months ago
phplovesong|3 months ago
Its still so annoying that you have to use mb_real_uppercase($name) for unicode. The other gripe is that the stdlib is SO messy. With PHP 5.3 they had a once in a lifetime opportunity to cleanup the stdlib and introduce a new namespaced API for builtins, and optionally introduce a uniform function call syntax:
Whenever doing PHP the time for concurrency will come sooner or later. Having no way of doing ANY concurrency is a letdown. The Fiber API does nothing on its own, and you are forced to use some third party runtime, that is usually a non-starter for legacy projects.PHP has come a long way from the PHP 4.0 era, but is still lacking in multiple areas, and i dont see it being a pick for greenfield projects in 2025.
senfiaj|3 months ago
As for concurrency/async, it's possible to do requests in parallel with curl_multi_*. Other async/prallel things are also possible, but tend to be more complicated compared to JS or other languages with promise and async support.
spiderfarmer|3 months ago
You don't see it because you're not looking. There are many Laravel jobs in my area. If you think that is only for Legacy projects, might be mistaken.
mg|3 months ago
Epskampie|3 months ago
As for the partial function application, there is already an RFC to add that, but it's not decided on as of now. [2]
1: https://www.php.net/manual/en/functions.first_class_callable...
2: https://wiki.php.net/rfc/partial_function_application_v2
2WSSd-JzVM|3 months ago
rafark|3 months ago
dzonga|3 months ago
PHP like Ruby had some big companies built on it - Facebook: PHP, Ruby: Github/Shopify
PHP was able to swallow Hack and become PHP8 - they optimized for getting beginners into the language / ecosystem
Ruby while a beautiful / friendly language and ecosystem - got into political wars - didn't optimize for beginners on windows etc
even as a person who favors Rails - Laravel is ahead -> on documentation & bringing various ways to do things into the framework. There's no stick with Hotwire. You wanna do livewire go ahead, we will help you. You wanna do Inertia + JS - go ahead we will help you.
ReptileMan|3 months ago
Probably because compile/interpret is one way street. There is no way to lets say view/transform a part of the code in functional or imperative depending on what you need to do with it.
Reading modern php or even worse mixed generations code base feels like another full time job on top of the regular one - coding with it.
holoduke|3 months ago
spartanatreyu|3 months ago
PHP 8.2 has this:
``` readonly class BlogData
{
}```
Whereas in php 5.6, to accomplish the same you need all this:
``` class BlogData { /* @var string / private $title;
} ```onli|3 months ago
No, I'm not bitter.
niek_pas|3 months ago
squigz|3 months ago
stefanfisk|3 months ago
kreco|3 months ago
People pointing fingers to "outdated" languages for not having some of the most trendy constructs.
The pipe operator is definitely one of the feature that create more ways to do the same thing while providing unclear benefit.
Never in my life I was in a situation like "with the pipe operator this I would have saved me hours of debugging/reading/creating code".
yupyupyups|3 months ago
I remember when escaping SQL input data was "the correct way" to use your mysql database. Parametrization? Nah, just use mysql_escape_string or whatever it was called.
Octoth0rpe|3 months ago
So I guess it depends on what you mean by unhelpful. PHP as a language makes it pretty easy to do bad stuff. PHP as a community makes it easy to Do The Right Thing.
krapp|3 months ago
And let's be real - most handwritten SQL code in existence in most languages just builds queries from concatenated strings, even when more secure options exist. A lot of code doesn't even bother to escape anything. That's not a language problem so much as a developer laziness and assumption that "simplicity always equals correctness and frameworks are always wrong" problem.
amiga-workbench|3 months ago
g105b|3 months ago
Ayesh|3 months ago
nick-sta|3 months ago
hu3|3 months ago
dr0verride|3 months ago
tguvot|3 months ago
dotancohen|3 months ago
nalekberov|3 months ago
icar|3 months ago
johnisgood|3 months ago
---
Books:
* PHP & MySQL: Novice to Ninja by Tom Butler
* PHP 8 - Quick Scripting Reference by Mikael Olsson
* PHP 8 Objects, Patterns, and Practice by Matt Zandstra
* Programming PHP (2020) by Kevin Tatroe and Peter MacIntyre
I personally found them to be really good. I learned a lot from the first book especially.
You can find the code from the first book here: https://github.com/spbooks/phpmysql7
I hope this helps.
moebrowne|3 months ago
fbn79|3 months ago
browningstreet|3 months ago
gregoriol|3 months ago
Cthulhu_|3 months ago
nalekberov|3 months ago
[deleted]
mikedelfino|3 months ago
xonre|3 months ago
johannes1234321|3 months ago
Such a change makes it a completely different language with no compatibility. Thus all previous code is lost, no easy migration paths (especially for libraries which would like to support both during transition)
hu3|3 months ago
Maybe https://getrector.com could auto-fix 99% of code but it would still be very hard to get adoption.
thefounder|3 months ago
And a new language could have been developed , call it hack or whatever Facebook tried. Anyway I remember php coding gave me headaches. Tried it again 2 years ago and found out the same kind of issues(outdated /inexistent documentation, different ways to do the same thing that actually didn’t work and stuff like that). Try to connect to sql database using ssl and see what I mean.
I see no reason to learn PHP anymore or start up your company using php. We live in a vps/docker age. The advantage of php hosts everywhere has been lost.
hu3|3 months ago
But PHP is still so strong because it offers much more than "easy hosting".
What I personaly love most is the instant save file->see results feedback loop. There's no perceptible compilation step. Meanwhile my Java project takes a minute to compile.
Also the shared-nothing model by default is powerful and rare.
Laravel is probably the most well documented frameworks even comparing frameworks from other languages. And symfony, also a PHP framework, is not far from that.
When you say "SSL" I can only think your reasoning is based on outdated information since no one calls it SSL anymore. It's TLS for some years now. And I have been connecting to databases using PHP TLS/SSL since version 5. For almost a decade now.