IMO any good dev can be professional in any language, its just harder in some than others. It is a bit sad to see someone who has built up their knowledge and skill leave it because of its social stigma.
Why PHP is so successful? Well...
"Shantytowns are usually built from common, inexpensive materials and simple tools. Shantytowns can be built using relatively unskilled labor. Even though the labor force is "unskilled" in the customary sense, the construction and maintenance of this sort of housing can be quite labor intensive. There is little specialization. Each housing unit is constructed and maintained primarily by its inhabitants, and each inhabitant must be a jack of all the necessary trades. There is little concern for infrastructure, since infrastructure requires coordination and capital, and specialized resources, equipment, and skills. There is little overall planning or regulation of growth. Shantytowns emerge where there is a need for housing, a surplus of unskilled labor, and a dearth of capital investment. Shantytowns fulfill an immediate, local need for housing by bringing available resources to bear on the problem. Loftier architectural goals are a luxury that has to wait."
Well.. people that don't know how to code but want to hack in a 1 line dynamic thingy.. where else would they turn? It build a pretty good community for newcomers.
To be fair, FB struggled to scale with PHP, although it certainly fares better out of the box (even then). A lot of their work has gone into making PHP more performant and better by way of Hack.
PHP7 took a lot of great ideas from Hack but is still saddled with its legacy.
They did? I remember numerous Twitter outages due to scale and the infamous Fail Whale. Twitter's issues risked the company losing users or even it's sustainability as a business.
A few years later there would have been Rails or Django. With the strides FB made in PHP it would have been cool to see what they could have done with those frameworks/languages.
Facebook wouldn't likely exist if it wasn't for PHP. Zuck wrote something quickly in what he knew. They were able to deploy quickly, scale quickly, etc. Internally, they likely had the hope to migrate off of it at some point, but the business goals trumped the tech stack. From an outsiders point of view, no one cares about the tech problems they face with their tech stack.
PHP has always had this hyper productivity about it. You just made a change in your editor, saved the file, and refreshed your browser for rapid feedback. It's always been like that.
It's also stateless - less rope to hang yourself with.
Many web programming environments started with the same simple CGI model, but eventually moved away chasing performance (for the computer), and leaving behind rapid feedback during development time.
hyperdev.com is nice, but it's still way more complicated than a single file PHP app.
PHP became successful when hosting companies began offering cheap PHP hosting. PHP runs on low cost servers with very little memory,so hosting companies could put many customers on a single server.
It was then just a matter of uploading a few files via FTP to have a working website. .Net deployment, Java deployment were always more complicated and expensive. It was also easy for administrators to deploy Wordpress or Drupal, with next to no PHP knowledge whatsoever. That feature (ease of deployment) was often underestimated by other solutions, until the PAAS era.
Could PHP have been made better language wise while keeping the same features absolutely, but PHP was not taken seriously by people who could have fixed it early on.
I hate it, because it makes me feel defensive. PHP in their minds
is much worse than it practically is. Im tired of defending
PHP, Im tired of being set back and having to proof my compete
by virtue of being a PHP programmer.
For me it is the other way round. I like it when journalists ask me what super advanced tech stack I use. When I get tweets about what libraries I use in my projects. And students mail me questions about the technology behind my Startup. And I can reply "It is just your average LAMP stack".
I hate PHP too, but I write it almost every day at work. There's something to be said for how stable it is. I spent a large amount of my career doing .net development and deployed very rarely. It was a big day when I deployed. I would say to my wife, probably going to late tonight, we're deploying. Because something always went wrong when deploying.
Here, I deploy every other morning. Usually, while my coffee is getting to the right temp. The ability to just "throw it on the server", and to take it back if you need to make it great. There's a bunch of devs here, and that deploy all day long every day is one of the main reasons we move "so much faster" than our competition.
So as much as I hate how weird it is, and how frustrating it is not to have strong typing... i respect the heck out of it.
The thing is different languages lend themselves to different processes. Let's say you have the exact same bug in a web app, maybe you need to modify the where clause in the data layer of the app (or something small like that). In the C# version, you'll have to compile it and then push it. Maybe recycle the pool depending on factors in the architecture. In PHP, you just modify the file and throw it out there. Because of the slight differences, the nature of the way work is done leads to companies designing processes around it.
Same. It took us awhile at our company to wrap Octopus around our existing workflow (we don't do some things the way Octopus expects, but over time I found workarounds), but once a project gets set up, it's so super easy and just works, so much so that it's made deployment fast and predictable.
Once we switched over to Octopus we no longer had to bring several people on the team in and expect them to work 6+ hours on the weekend to do a deploy anymore, catch mistakes made during the deploy, etc. Now it's just done with a netops team clicking 'start' for each project, my boss on standby, and the whole thing done in about an hour, usually.
I understand what you are saying about easy-deployment. I work in PHP and .NET, and the difference I think comes down to deploying a few updated files to a PHP environment versus having to deploy your whole compiled application in .NET. Tools like Octopus and Visual Studio features mitigate the problem in .NET, but I totally know what you mean when I have to work without those tools and spend an hour trying to find some missing dependency or web.config entry in our project that often happens in .NET.
I still prefer .NET and C# for the cleanliness, correctness, and the fact that it's easy to write code that works the first time, but it is nice when I just need to update one PHP file and drop it on the server without any downtime to recompile on our WAMP server.
I used to feel the same way a lot of times, a shame it seems for being a PHP dev. Now, I don't care. I've been using it since 1999, and I use it to get stuff done.
My customers and users of my applications don't care what it's written in.
But, you should definitely learn more languages as a programmer.
> And to anyone considering programming as a career, or trying to get into it... stay away from PHP.
This is the part I disagree with the most. The language is getting better and better with every release. It's incredibly fast, much safer to use (the Error exception type, scalar static type hints, all the garbage from the early 2000's has been removed), and easy to work with. The ecosystem (with the introduction of Composer) has _completely_ changed and reinvigorated the language. It's easily one of the best package managers out there. I definitely recommend giving PHP a look or a second change if you've written it off.
It is far worse I would say. Legacy PHP code is some of the worst code I have seen in my life. Everyone with HTML/JS knowledge could also do PHP and they did. There are many production systems (banks, insurance etc included) running old style php with html mixed with php mixed with JS. And it runs fine, but if you need to fix something that broke or had to be changed...
I have seen some real crap in Python recently. Then I was asked to move a PHP app to a new server. A quick look at the code looked terrible - string concatenations for all the SQL. (Does PHP provide some way of making this safe, or should I warn management about potential SQL injection? I don't know a lot about PHP).
Unfortunately, the issues aren't with "new" PHP, it's with the mountains of "old" PHP code that invariably finds its way into your project.
Also, having had to maintain a Wordpress site the past few months, may God have mercy on all daily Wordpress devs. I truly admire your stalwartness now in putting up with that.
The problem is that clients really want WP a lot. Bigger and bigger companies currently and for most of their departmental sites. This is WP shoe-horned in a full site CMS function. The thing is, users seem to love it. I would wager that if you just rip out the guts of PHP and leave only the frontend (the /wp-admin part that is), but leave it 100% as it is and write a solid backend in Django/Rails, you have a winner. The problem is that when people attempt this, their own 'taste' comes in and it always ends up being a vastly different frontend which then users don't want as it's not 'the same as WP'.
Before anyone says it; sure some users use WP for the themes and plugins; we use some of them but we are very careful using plugins. They have to be rocksolid for many years, actively supported and we have to have reviewed the code. Next to that they have to add something significant; installing a plugin for some social buttons is very much not worth the pain of updates / security breaches on a 100k+ (+ SLA) project. And so in the end we end up using 4-5 the same plugins for projects and the rest is either not needed or easy to implement anyway. So the hero implementing those guts in Django/Rails could also implement those plugins. I believe you would have something safe for the enterprise. Until then, they'll just use WP and trust admins/coders to fix the issues.
> I would wager that if you just rip out the guts of PHP and leave only the frontend (the /wp-admin part that is), but leave it 100% as it is and write a solid backend in Django/Rails, you have a winner.
I would love for WP to exist as only an admin interface to a clean, backend data store. Unfortunately, the problem is the database schema that WP ships with and the way WP handles data. It's almost impossible to get data out of WP press without using its lackluster DB "abstraction" layer and running the fetched data through its many obscure filtering mechanisms. To top it off, WP smashes everything into a handful of tables and makes doing normal, straightforward relational looks up (as any sane schema would allow for) a complete nightmare. Alas, when you go the WP route, your data is very much dependent on WP (and by default PHP).
Any organization that uses WP for an extended period of time and builds up a non-insignificant amount of data will run into this wall, guaranteed. If you truly value your data and your project is anything beyond a personal blog that you'll give up on in 6 months time, do yourself and your organization a favor and find an alternative solution. If you must use WP, use it as what it was originally intended for: a blog. It's not a framework to develop a complex application off of.
I agree with everything you said here but I can explain this to clients usually however not always. There is, for instance, a supermarket chain running all their web through WP. They spent and spend millions on it; they cannot be convinced and although I might not choose a certain tech for my own company assets, I am not spreading religion (although as I get older I feel more and more the need to do so) and we are not in the position to just say no to large contracts.
As the person who wrote a patch to import data from WP to Pelican I agree. It's a complete nightmare. In order to properly maintain the formatting from ~6 years of blog posts I had to literally translate the PHP code that parsed the database representation into Python... which is some really gnarly code.
Have you looked at/heard about the WP REST API[1]? Basically, it allows WP to function as that backend admin tool that you talked about, and you can build the front end as what ever you want[2].
> The problem is that clients really want WP a lot.
This. I can waste my breath talking about another CMS which is better suited for the task, has cleaner data representation (good for 5 years' time) etc, and try to get stakeholders to buy into it. Or I can mention WordPress and have brand recognition do the work for me.
> The thing is, users seem to love it.
In my experience, the users find the admin confusing. It's the managers and above who love it. They know what they're getting and it feels safe.
It used to be "You're never fired for buying IBM". Now it's "You're never fired for buying WordPress".
> In my experience, the users find the admin confusing.
My 'entry' into the enterprise world was web CMSs; my previous company used to make/sell a respected web CMS. If you talk about 'confusing admins' then the web CMS world is where you should look. Boot up a Liferay (oh and check out that code by the way) or Alfresco or Sitecore or Oracle CMS and stare in disbelief.
This is what these users are used to and compared with those, WP is really very simple. That's why no (?) enterprise will replace an international corporate roll-out with WP, but regional, if allowed (and it usually is as marketing simply doesn't work the same way worldwide), they will. Because of the ease and less friction; create a new content writer? Fill in paper work and ask the main IT dep vs do it yourself in 5 seconds and that kind of thing.
"old" PHP code should not be finding it's way into your project. Use a facade, adapter, proxy or bridge pattern to decouple your new shiny awesome code from the legacy cruft.
I understand that the negative pressure can have a long term effect. Personally that has never gotten to me and it's sad for the author that they have been slowly worn down over time to a breaking point.
I totally agree with "But, you should definitely learn more languages as a programmer." In my current position I led a ground up build in Python/Django after 10 years of personally using PHP. I learned so much that I wanted to bring back to the PHP stack, only to find that the PHP community is already working on those things. It's really fun to see the parallels.
I am a strong believer in coding fundamentals and try to preach language agnosticism to my team. Yes there is often a right tool for the job, but in many cases the major platforms will be able to achieve the problem at hand – at least for typical problems.
If you're a PHP dev, you really ought to add a complementary language, not one that, like Python, is really quite similar when it comes down to it in terms of performance, execution model, language features, etc. There's a lot of good options out there and there's more coming every year now. Go is a nice choice because it really nicely complements PHP, being good at some things that PHP is bad at, and PHP being good at some things Go is bad at. Rust might be a good choice with just a bit more web dev work on it. Erlang/Elixir, Clojure, something with a great concurrency story, an easier time getting to high performance, and some (good) static typing for when you're in the code where that's a good idea, that sort of thing. PHP->Python is not a bad thing necessarily, but it's not really "diversifying" very much.
Resume driven devlopment. As you say PHP and Django are similar in what you can use them for. I would choose either of the over Rust for a standard web app. Unless you have a specific need for concurrency, the PHP and Django are far more mature in the web app space.
I also disagree strongly with that piece of advice. Even though, as others have pointed out, if you become a PHP developer you're going to have to deal with nasty legacy code; there's nasty code written in Ruby, Java, Python, etc. too. It's just nasty in a different way.
PHP is actually the language I do recommend people learn if they're interested in web development (obviously along with JavaScript), because PHP developers are in high demand. PHP developers can always find work, precisely because there is so much PHP out there.
Asp.net on linux, Go, Elixir, Python, Ruby,Java ...
PHP kinda saved itself when it got Java like classes(which are fairly rigid thus allowed retrofitting "type safety" in PHP) which allowed engineers to write large and maintainable codebases (Symfony,Doctrine...).
So again, no need to complain, go see your manager and try to convince him to try an alternative solution. Of course if you're using a CMS like Worpdress or Magento it might be a bit more complicated to migrate. But for projects started from scratch frankly, an engineer that can write a Symfony/Doctrine app can easily switch to Asp.net, it's exactly the same level of complexity.
PHP get in your way only when your starting.
You never make these "bad language mistakes" once you're experimented. And then you can write really clean code.
ASP, however, makes me vomit everytime I read a single line.
COBOL is more readable !
C# (the most commonly used ASP.Net language) is one of the best designed mainstream languages out there. I'm not a fan of any of the ASP.Net web frameworks, but the language itself is great.
"The 2016 StackOverflow Survey puts PHP developers as the least paid" - which is very unfair. I think PHP developers should actually get paid more as compensation for having to put up with PHP on a day-to-day basis, but that's just me unfortunately...
I've been doing primary PHP for almost ten years and people honestly just throw money at me to solve their problems. I really don't know how I make as much as I do; I hit the point where I made more than my parents combined a few years back and that made for a strange reflection point in my life.
Basically for all the decent PHP developers I've known in my life money has never been an issue.
Not being a developer, but having had lot's of great moments with them, I can say, that in my tangenital environment there are lots and lots of school taught mediocre to bad PHP devs, that always find jobs, but on a very low pay grade (and rightly so).
So maybe there are lots of mediocre php devs pulling the average down?
I think the low salaries are more a reflection of the fact that there are a lot of inexperienced developers writing PHP and that there is a lot of unimportant software written in PHP than it is that a given developer would make less by using PHP. A highly talented developer working on business critical software will make a lot more than an untalented developer working on low value software regardless of whether each piece of software is in PHP or Java; it's just that the first scenario is more common in Java than in PHP and the second scenario is more common in PHP than in Java.
That's a pretty useless truth, who doesn't know that?
Many languages (like Go or Clojure) require you to learn quite a few concepts and exercise your mind in general. This automatically filters out incompetent programmers, and puts the rest in the right mindset.
I don't really agree on Go, however it is true that some programming languages scare away beginners.
I wouldn't say that it filters out incompetence completely though. I remember when I was writing Prolog for a school project and wasn't familiar with any of its concepts. I ended up writing terrible Prolog that looked a whole lot like the imperative stuff I was used to (wait, comma doesn't mean next instruction?!).
The author's biggest mistake wasn't betting on PHP, it was betting on a single language. He should have learned more languages a long time ago, just to expand his set of tools, and maybe way of thinking.
Besides, learning a new language is fun and not that hard... They are all pretty much the same...
... until you try to switch paradigms (e.g. to Lisp, Erlang or Haskell).
I agree that learning new languages is very useful. But as analogies go, going from PHP to another imperative language is more like switching dialects than learning a foreign language.
The thing that hurts PHP the most is lack of structure and patterns used in the most popular projects. These popular projects are usually where the bulk of work lies, where developers point to when they're considering PHP. When juniors start they're typically working on WordPress or Drupal. The problem is that WordPress and Drupal are terrible guides of how to write a web app and that knowledge is completely useless when you go to write something in an actual framework. I was expecting a lot with Drupal 8 but I decided against using it entirely after reviewing the codebase and testing it out, 7 is in no way compatible with 8 and you have to start over.
When you step outside these mini ecosystems and look at PHP as a vanilla tool to work or to use a proper micro/full framework you start to question why use PHP at all? One possibly acceptable framework, in my opinion, is Laravel. The problem is PHP outside of these mini ecosystems isn't nearly as popular. It looks like people migrate to an entire new language like Python, Ruby, Node, etc. If we're talking about sheer people hiring Ruby, Node and Python typically trump PHP every time and are using frameworks - not Drupal or WordPress. Granted there are custom PHP apps out there and some very good ones but they're not the norm.
I switched full-time to Python using Flask and Django. It's like a breath of fresh air. My 2 cents is if you're on the fence, figure out how to work on one project using this new language full-time. Then you can make a better decision.
I used to like Laravel, but lately it feels so enterprisy. There is a lot of boilerplate in Laravel today and it was changing too fast for me to keep up with it.
I have no idea since I don't use Laravel or PHP anymore, but I tried it a couple of months ago and it seemed completey different from a year ago or more.
I like Laravel Elixir (the npm package) and Eloquent (the ORM). Laravel itself is overly complex and the learning curve keeps getting higher. I'm much happier with Slim 3
I think with the composer package manager mixing and matching components fais what makes modern PHP so effective. I'm using the mini-framework Silex and a bunch of components I find useful (twig, phpexcel ).
The thing that kept me away from it for actual enterprise use was the fact the project is run by a single person. Where would it be without Taylor? Django and others have actual foundations that will keep it going for the long-term, more mindshare and more committers as part of the core project team.
The flip side of that question, though, is "where would Laravel be if it were built by committee rather than benevolent dictator?" I'd wager Taylor's "I'm doing shit my way" has been at least part of what has made Laravel so successful.
In my most recent (side) project, I'm doing a Yii2 website and I'm feeling like it's not enterprisey enough. I have to go out of my way to figure out the best way to split things apart (which, I guess is good because it doesn't actually make that difficult for me at all - it's just something I have to choose to do)
I used Yii2 at a previous job. The way that it splits things out feels horrendous. The documentation is sub-par, and I feel like I spent more time trying to figure out why something didn't work the way I expected (from reading the code) than I did fixing things.
I'm sure at least some part of that was the previous developer who built the application. But there is absolutely no reason for documentation to not answer the basic questions that seem to come up many times per day in their IRC channel.
I commonly recommend Yii and laud it's extensive documentation and "Definitive Guide" that covers basically everything.
In my current experience as a developer, Yii's documentation is the best I've ever utilized. Much better than any Javadoc I've googled or even php.net's
What are forms and form validation like in Yii? [Have looked at the docs, but after real-world usage]
I've used form libraries from the PHPClasses one back in 2003 through Symfony forms now (which has cognitive overload, and is so flexible as to be restrictive). Most business systems I write are data focused so forms play a massive role in them - and in my developer happiness.
Validation works directly with the model and you can pick a number of ways to check the input and have it return an appropriate error message.
The view/controller layers are very flexible and can be hooked up to anything from an HTML template using Yii to angular/bootstrap (which is what we're using) or another framework to handle the forms.
Use it at my current job. Also used li3 before that. The current version works pretty well without having any of the weirdness that can plague a framework once it gets more mature and people start wanting to graft in whatever is trendy from other projects.
What I like about it is the flexibility of the ORM, where you can use the model in a sane way but can completely toss it aside and just use SQL for those edge cases that would be a PITA in something like Django.
> I used to like Laravel, but lately it feels so enterprisy.
You think that feels enterprisy? Try Symfony, and listen to the community, with its "way to do things" that change every 6 months depending what's in vogue - and each time are invariably more abstract and complicated.
The thing that hurts PHP is also the very thing that makes it popular and creates the demand. it's easier to build things with it. It's damn near the BASIC of backend programming.
> 7 is in no way compatible with 8 and you have to start over
There's an upgrade path, sort of, but more importantly major versions of Drupal live for years. I think we'll keep seeing new D7 projects for at least 2 more years.
The point isn't that it's easy or hard. It doesn't require the user to understand things like scope or the rudiments of typing to get started, which means it's insanely permissive.
Yeah, I could understand that perception if chainsaws were given away for free to everyone who owned a house in the woods, and if they were touted as an easy-to-use entry-level sawing device.
I left PHP for C# and JS. I've been burnt so many times from the tacky standard library it's not even funny. Coding php in a large application is both boring and hard. XDebug barely works and is hard to set up.
Still, PHP is so goddamn cheap it's not even funny. But I recognize everything the author is describing.
I don't fully understand what you mean but if you're saying it will under-perform with this hardware I assure you that it will scale better then Node.js :)
This is one of my fears, as I work primarily modernizing PHP applications.
I think it's possible my salary has hit a plateau. Most SMBs do a false equivalence between PHP developers and junior developers. One place I worked at the owner used to brag about hiring people starting out for $12/hr.
The thing is, with my experience in PHP it's easier for me to write secure code in PHP than anything else at this point. I can do it really fast, too. I've internalized a lot of micro-optimizations in PHP. Project scaffolding on a greenfield project ends up looking a LOT like Express if you use the Slim framework. And I stay away from PHP if I need concurrency (and so far, per business requirements, I haven't). I can scale it really well, and I rarely have to worry about memory limits like you do with the JVM.
I'm hoping for a breath of fresh air with PHP7, because I'm not entirely sold on the current runtime alternatives - JavaScript, Python or Ruby. I've been trying Scala and I write less code than Java, but definitely more than PHP. It's also hard to jump into the Play framework if you don't grok the 'weird' operators. I also find that it's easier to hang yourself with incompatible components/libraries. So far it's fun to write though, but I don't think I've seen anyone hiring for Scala in my town.
What Evert is referring to (the "reputation" of PHP and people's reactions) is even worse in infosec. I very frequently get accused of being a charlatan simply because I write PHP.
This is silly when you think about it. If so many systems run PHP, wouldn't you want your infosec people to know PHP and work with it more often? Why are we, culturally, encouraging such a blind spot by ostracizing folks who know it well? That part never made sense to me.
This conversation plays out more frequently than I like:
Rando: Hahaha PHP security is an oxymoron.
Me: Okay, then hack paragonie.com. It runs PHP. Logically, you should
be able to hack it _just for running PHP_ if PHP is so insecure.
Rando: But that website's mostly static content!
Me: Yes, but it runs PHP. So it must be insecure, right?!
So far, despite giving people permission so the prospect of CFAA convictions don't discourage them, none of these "PHP is inherently insecure" folks have succeeded. I wonder why. :)
TL;DR - A lot of the hate against PHP is founded on ignorance and peer pressure. Be open to constructive criticism, of course, but a lot of the hate you'll hear is bullshit.
My company does penetration testing and most of the projects involve web apps. Our clients use PHP, J2EE and .NET, and after 7 years of operation, we clearly see a trend where the number and severity of security issues are highest in PHP apps, lowest for .NET, with J2EE in the middle. Of course, there's the odd secure PHP app and the .NET project with gaping holes, but the trend is obvious.
So it's not peer pressure, we actually have data to back this up, and if you think about it, the whole thing boils down to motivation. Sure, you can write secure and insecure code as well in any language/environment. But defaults are powerful, and it makes me feel sad every time I have to write in reports that "you should've paid attention to opt-in to the secure solution every time you do X" vs. when we do demos to developers and we have to work really hard to disable every protection built into ASP.NET. (And no, I don't like Microsoft at all.)
Please tell me more about these PHP projects, if you have the data available to you.
* Did they support EOL'd versions of PHP?
* Are they legacy WordPress/Drupal/Joomla projects that haven't been updated in years?
* Are they in the "we (didn't use a framework|rolled our own framework) and used the mysql_* functions" league?
* Did they attempt to do something weird/crazy (i.e. store all session state in an encrypted cookie instead of server-side like normal, but forget to authenticate the ciphertext)?
Those are the kinds of things that I rarely find in modern PHP projects.
One thing I think Evert neglected to mention in his post: There's definitely an ecosystem problem. Incidentally, I've been working on cleaning it up on multiple fronts:
* Improving the quality of information developers will find via Google search or StackOverflow
* Improving the security of the tools and frameworks developers use
* Working to improve the language itself (part of the reason why PHP 7's CSPRNG functions don't fail open is because a few of us were very vocal on how/why that would harm security)
I know little about most of them, since we did penetration testing (simulating what could an attacker over the 'net do) most of the time, as few of our clients have the budgets for a proper source code review. No CMSs were used, we had one Wordpress, but that was actually almost perfect, since they kept it up to date. These projects were custom-made business applications, not "dynamic" web sites.
Frameworks were sometimes used, although their effect on security is somewhat baffling at first sight -- and this is regardless of the platform, although we found most issues with PHP and J2EE. Sure, when you use the framework for security-critical things such as constructing SQL queries (SQLi) or HTML output (XSS), things work quite well. However, since most developers don't think about these issues, the single time they have to "escape" from the framework, since it doesn't (or they just think it doesn't) support a certain scenario, they don't know about all the things PHP and in smaller ways, J2EE requires to do for security.
Of course, this way, the framework protects 9x% of the application, but the asymmetry of security is that the attacker only needs a single vulnerability while the defender must patch it all.
I'm not surprised to hear that custom-made business applications fared so poorly. Back when I worked for a telecommunications company, I saw some of the worst code imaginable endorsed by corporate and deployed to production with wild abandon. I reported no less than 10 vulnerabilities in my first day with a new codebase and they were all ignored. My boss took me aside and said, "There's some politics going on right now, just keep that in your back pocket in case you need to bring it up later. Now's not the time."
> ... And to anyone considering programming as a career, or trying to get into it… stay away from PHP. There’s lots of fun, interesting languages out there that also get the job done quick, but with a better reputation and this will have an actual effect on your future career options.
> Looking for a PHP developer for your next project? I'm looking for work! Check out my resume or drop me a line!
I don't think you can argue it's just an opinion. I haven't seen anyone argue that php isn't badly designed or implemented. Other than stating that it works and you can work around it.
I worked at a PHP-based company and after a year of intense interviewing, we finally decided to switch core languages and tech stacks because we weren't attracting strong enough candidates.
What we found is that most good programmers didn't want to work in php and most php developers were designers that learned how to code php. But they didn't understand CS fundamentals or even a decent idea how to code. They could cobble together a web site that worked and even looked great, but they didn't know how to write maintainable, modular code.
It got to the point where I would ask the candidate to merge two sorted arrays and 70% couldn't do it properly.
In terms of language, I thought php itself was a surprisingly productive language. I just quit though because I didn't want to be known as a php developer because of the stigma and there poor quality of other php developers that I encountered.
I found that if you advertise for php programmers you get mostly people working on fairly simple web applications. The more talented programmers would apply when we emphasized that we use php for the front of the backend systems, but we also use Go and node.js for more realtime parts of what is a suite of micro services. once we got them in the door they were happy and productive php programmers
I found that if you advertise for php programmers you get mostly people working on fairly simple web applications. The more talented programmers would apply when we emphasized that we use php for the front of the backend systems, but we also use Go and node.js for more realtime parts of what is a suite of micro services. once we got them in the door they were happy and productive php programmers
I'm by no means an expert on PHP but whenever I begin having similar thoughts like the author, or begin having internal language religion wars in my head about PHP, i remember that PHP actually stands for "PHast Prototyper" (language/platform)..and tools/platforms like that have their place in the world to help us...and then this thought allows me to regain my peace and progress forward on my day (focusing on bigger things). This does not mean PHP is inherently good or bad, merely a tool; to be used under the right conditions (in this case rapid dev.).
Perhaps remembering that PHP could mean "PHast Prototyper" could help you/your team come to terms with all this?
"The problem I have with PHP has nothing to do with the language, it’s its reputation. I can’t count the times I’ve started a conversation with a programmer who upon finding out I primarily do PHP got awkward with me."
The HN post title is sure helping with the reputation.
It's not about a language or a technology, it's about what you do or can do with it...
All trendy technologies might be replaced anytime (hey React, Go, I'm looking at you!), one day they are very cool, the next day nobody maintains them and everyone talks about another new cool thing; how many of these have we seen?
New cool stuff are important to know, explore, test, use because they bring a lot of interesting stuff, but often they only address some use cases, as they have been made by a team with specific needs (looking at all hundreds NoSQL databases?); php and some others (like ruby) are stable, well known, cover a vast area of use cases with very well made and long thought frameworks and tools (symfony, doctrine, phpstorm, ...).
You are always free to follow trends, like with clothes, or just choose the best thing for what you need to do. You'll definitely find jobs with any of these, if you are able to explain why they are good for what you are doing.
Once you need a framework and the complexity that goes with it, PHP starts to suck. It lacks the behavior and tools to nicely manage complexity beyond a pile of files.
But when what you need is a pile of files, PHP is awesome.
With PHP you can grow your own infrastructure from being a couple of calls to your RDBMS/MySQL up to installing modern libs and implementing a framework.
On the other hand: With RoR, Python, NodeJS, et al (which by itself can do anything, since they need frameworks and libraries for anything web-related) you have to start with these HUGE dependencies and package managers that only add more technical debt to your project plus your projects can't start from dead-simple bd-calls it has to be all or nothing and under the same structure because "it's the right thing to do bro, you will thank me later"... guess what: i still don't use everything.
The day a languages appears that is web-ready and dead-simple with no technical debt that's the day we can say: PHP Suck.
296 comments
[ 2.9 ms ] story [ 314 ms ] threadWhy PHP is so successful? Well...
"Shantytowns are usually built from common, inexpensive materials and simple tools. Shantytowns can be built using relatively unskilled labor. Even though the labor force is "unskilled" in the customary sense, the construction and maintenance of this sort of housing can be quite labor intensive. There is little specialization. Each housing unit is constructed and maintained primarily by its inhabitants, and each inhabitant must be a jack of all the necessary trades. There is little concern for infrastructure, since infrastructure requires coordination and capital, and specialized resources, equipment, and skills. There is little overall planning or regulation of growth. Shantytowns emerge where there is a need for housing, a surplus of unskilled labor, and a dearth of capital investment. Shantytowns fulfill an immediate, local need for housing by bringing available resources to bear on the problem. Loftier architectural goals are a luxury that has to wait."
- http://www.laputan.org/mud/
Now as to why a facebook would use it? mindblown
PHP7 took a lot of great ideas from Hack but is still saddled with its legacy.
Never remember Facebook having much issue.
It's also stateless - less rope to hang yourself with.
Many web programming environments started with the same simple CGI model, but eventually moved away chasing performance (for the computer), and leaving behind rapid feedback during development time.
hyperdev.com is nice, but it's still way more complicated than a single file PHP app.
That's its best feature and I love it.
It was then just a matter of uploading a few files via FTP to have a working website. .Net deployment, Java deployment were always more complicated and expensive. It was also easy for administrators to deploy Wordpress or Drupal, with next to no PHP knowledge whatsoever. That feature (ease of deployment) was often underestimated by other solutions, until the PAAS era.
Could PHP have been made better language wise while keeping the same features absolutely, but PHP was not taken seriously by people who could have fixed it early on.
Here, I deploy every other morning. Usually, while my coffee is getting to the right temp. The ability to just "throw it on the server", and to take it back if you need to make it great. There's a bunch of devs here, and that deploy all day long every day is one of the main reasons we move "so much faster" than our competition.
So as much as I hate how weird it is, and how frustrating it is not to have strong typing... i respect the heck out of it.
We've since learned that this is problematic.
It's a company issue.
Once we switched over to Octopus we no longer had to bring several people on the team in and expect them to work 6+ hours on the weekend to do a deploy anymore, catch mistakes made during the deploy, etc. Now it's just done with a netops team clicking 'start' for each project, my boss on standby, and the whole thing done in about an hour, usually.
I still prefer .NET and C# for the cleanliness, correctness, and the fact that it's easy to write code that works the first time, but it is nice when I just need to update one PHP file and drop it on the server without any downtime to recompile on our WAMP server.
My customers and users of my applications don't care what it's written in.
But, you should definitely learn more languages as a programmer.
> And to anyone considering programming as a career, or trying to get into it... stay away from PHP.
This is the part I disagree with the most. The language is getting better and better with every release. It's incredibly fast, much safer to use (the Error exception type, scalar static type hints, all the garbage from the early 2000's has been removed), and easy to work with. The ecosystem (with the introduction of Composer) has _completely_ changed and reinvigorated the language. It's easily one of the best package managers out there. I definitely recommend giving PHP a look or a second change if you've written it off.
Take a glance at http://www.phptherightway.com/ to get started
Also, having had to maintain a Wordpress site the past few months, may God have mercy on all daily Wordpress devs. I truly admire your stalwartness now in putting up with that.
Before anyone says it; sure some users use WP for the themes and plugins; we use some of them but we are very careful using plugins. They have to be rocksolid for many years, actively supported and we have to have reviewed the code. Next to that they have to add something significant; installing a plugin for some social buttons is very much not worth the pain of updates / security breaches on a 100k+ (+ SLA) project. And so in the end we end up using 4-5 the same plugins for projects and the rest is either not needed or easy to implement anyway. So the hero implementing those guts in Django/Rails could also implement those plugins. I believe you would have something safe for the enterprise. Until then, they'll just use WP and trust admins/coders to fix the issues.
I would love for WP to exist as only an admin interface to a clean, backend data store. Unfortunately, the problem is the database schema that WP ships with and the way WP handles data. It's almost impossible to get data out of WP press without using its lackluster DB "abstraction" layer and running the fetched data through its many obscure filtering mechanisms. To top it off, WP smashes everything into a handful of tables and makes doing normal, straightforward relational looks up (as any sane schema would allow for) a complete nightmare. Alas, when you go the WP route, your data is very much dependent on WP (and by default PHP).
Any organization that uses WP for an extended period of time and builds up a non-insignificant amount of data will run into this wall, guaranteed. If you truly value your data and your project is anything beyond a personal blog that you'll give up on in 6 months time, do yourself and your organization a favor and find an alternative solution. If you must use WP, use it as what it was originally intended for: a blog. It's not a framework to develop a complex application off of.
[1] http://v2.wp-api.org/
[2] An example of a front end powered by the WP REST API https://github.com/ustwo/ustwo.com-frontend
This. I can waste my breath talking about another CMS which is better suited for the task, has cleaner data representation (good for 5 years' time) etc, and try to get stakeholders to buy into it. Or I can mention WordPress and have brand recognition do the work for me.
> The thing is, users seem to love it.
In my experience, the users find the admin confusing. It's the managers and above who love it. They know what they're getting and it feels safe.
It used to be "You're never fired for buying IBM". Now it's "You're never fired for buying WordPress".
My 'entry' into the enterprise world was web CMSs; my previous company used to make/sell a respected web CMS. If you talk about 'confusing admins' then the web CMS world is where you should look. Boot up a Liferay (oh and check out that code by the way) or Alfresco or Sitecore or Oracle CMS and stare in disbelief.
This is what these users are used to and compared with those, WP is really very simple. That's why no (?) enterprise will replace an international corporate roll-out with WP, but regional, if allowed (and it usually is as marketing simply doesn't work the same way worldwide), they will. Because of the ease and less friction; create a new content writer? Fill in paper work and ask the main IT dep vs do it yourself in 5 seconds and that kind of thing.
I totally agree with "But, you should definitely learn more languages as a programmer." In my current position I led a ground up build in Python/Django after 10 years of personally using PHP. I learned so much that I wanted to bring back to the PHP stack, only to find that the PHP community is already working on those things. It's really fun to see the parallels.
I am a strong believer in coding fundamentals and try to preach language agnosticism to my team. Yes there is often a right tool for the job, but in many cases the major platforms will be able to achieve the problem at hand – at least for typical problems.
PHP is actually the language I do recommend people learn if they're interested in web development (obviously along with JavaScript), because PHP developers are in high demand. PHP developers can always find work, precisely because there is so much PHP out there.
The stigma remains. All other things being equal, choose a language where you're not going to have to fight this fight.
Asp.net on linux, Go, Elixir, Python, Ruby,Java ...
PHP kinda saved itself when it got Java like classes(which are fairly rigid thus allowed retrofitting "type safety" in PHP) which allowed engineers to write large and maintainable codebases (Symfony,Doctrine...).
So again, no need to complain, go see your manager and try to convince him to try an alternative solution. Of course if you're using a CMS like Worpdress or Magento it might be a bit more complicated to migrate. But for projects started from scratch frankly, an engineer that can write a Symfony/Doctrine app can easily switch to Asp.net, it's exactly the same level of complexity.
https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/
PHP get in your way only when your starting. You never make these "bad language mistakes" once you're experimented. And then you can write really clean code.
ASP, however, makes me vomit everytime I read a single line. COBOL is more readable !
There's nothing unreadable about .Net.
Basically for all the decent PHP developers I've known in my life money has never been an issue.
So maybe there are lots of mediocre php devs pulling the average down?
Same for JS.
Many languages (like Go or Clojure) require you to learn quite a few concepts and exercise your mind in general. This automatically filters out incompetent programmers, and puts the rest in the right mindset.
I wouldn't say that it filters out incompetence completely though. I remember when I was writing Prolog for a school project and wasn't familiar with any of its concepts. I ended up writing terrible Prolog that looked a whole lot like the imperative stuff I was used to (wait, comma doesn't mean next instruction?!).
Besides, learning a new language is fun and not that hard... They are all pretty much the same...
I agree that learning new languages is very useful. But as analogies go, going from PHP to another imperative language is more like switching dialects than learning a foreign language.
When you step outside these mini ecosystems and look at PHP as a vanilla tool to work or to use a proper micro/full framework you start to question why use PHP at all? One possibly acceptable framework, in my opinion, is Laravel. The problem is PHP outside of these mini ecosystems isn't nearly as popular. It looks like people migrate to an entire new language like Python, Ruby, Node, etc. If we're talking about sheer people hiring Ruby, Node and Python typically trump PHP every time and are using frameworks - not Drupal or WordPress. Granted there are custom PHP apps out there and some very good ones but they're not the norm.
I switched full-time to Python using Flask and Django. It's like a breath of fresh air. My 2 cents is if you're on the fence, figure out how to work on one project using this new language full-time. Then you can make a better decision.
I like Laravel Elixir (the npm package) and Eloquent (the ORM). Laravel itself is overly complex and the learning curve keeps getting higher. I'm much happier with Slim 3
It works pretty well.
The flip side of that question, though, is "where would Laravel be if it were built by committee rather than benevolent dictator?" I'd wager Taylor's "I'm doing shit my way" has been at least part of what has made Laravel so successful.
In my most recent (side) project, I'm doing a Yii2 website and I'm feeling like it's not enterprisey enough. I have to go out of my way to figure out the best way to split things apart (which, I guess is good because it doesn't actually make that difficult for me at all - it's just something I have to choose to do)
I'm sure at least some part of that was the previous developer who built the application. But there is absolutely no reason for documentation to not answer the basic questions that seem to come up many times per day in their IRC channel.
I commonly recommend Yii and laud it's extensive documentation and "Definitive Guide" that covers basically everything.
In my current experience as a developer, Yii's documentation is the best I've ever utilized. Much better than any Javadoc I've googled or even php.net's
I've used form libraries from the PHPClasses one back in 2003 through Symfony forms now (which has cognitive overload, and is so flexible as to be restrictive). Most business systems I write are data focused so forms play a massive role in them - and in my developer happiness.
The view/controller layers are very flexible and can be hooked up to anything from an HTML template using Yii to angular/bootstrap (which is what we're using) or another framework to handle the forms.
What I like about it is the flexibility of the ORM, where you can use the model in a sane way but can completely toss it aside and just use SQL for those edge cases that would be a PITA in something like Django.
Some related discussion here: https://laracasts.com/index.php/discuss/channels/general-dis...
You think that feels enterprisy? Try Symfony, and listen to the community, with its "way to do things" that change every 6 months depending what's in vogue - and each time are invariably more abstract and complicated.
There's an upgrade path, sort of, but more importantly major versions of Drupal live for years. I think we'll keep seeing new D7 projects for at least 2 more years.
I've built a static analysis tool for it, and it sort of feels like writing a CAD tool for lego bricks.
Still, PHP is so goddamn cheap it's not even funny. But I recognize everything the author is describing.
Yes, every popular language has critics, but that doesn't mean they're always wrong.
I think it's possible my salary has hit a plateau. Most SMBs do a false equivalence between PHP developers and junior developers. One place I worked at the owner used to brag about hiring people starting out for $12/hr.
The thing is, with my experience in PHP it's easier for me to write secure code in PHP than anything else at this point. I can do it really fast, too. I've internalized a lot of micro-optimizations in PHP. Project scaffolding on a greenfield project ends up looking a LOT like Express if you use the Slim framework. And I stay away from PHP if I need concurrency (and so far, per business requirements, I haven't). I can scale it really well, and I rarely have to worry about memory limits like you do with the JVM.
I'm hoping for a breath of fresh air with PHP7, because I'm not entirely sold on the current runtime alternatives - JavaScript, Python or Ruby. I've been trying Scala and I write less code than Java, but definitely more than PHP. It's also hard to jump into the Play framework if you don't grok the 'weird' operators. I also find that it's easier to hang yourself with incompatible components/libraries. So far it's fun to write though, but I don't think I've seen anyone hiring for Scala in my town.
Some people openly question if a PHP developer who understands security exists at all: https://twitter.com/MalwareJake/status/506488937096183808
This is silly when you think about it. If so many systems run PHP, wouldn't you want your infosec people to know PHP and work with it more often? Why are we, culturally, encouraging such a blind spot by ostracizing folks who know it well? That part never made sense to me.
This conversation plays out more frequently than I like:
So far, despite giving people permission so the prospect of CFAA convictions don't discourage them, none of these "PHP is inherently insecure" folks have succeeded. I wonder why. :)TL;DR - A lot of the hate against PHP is founded on ignorance and peer pressure. Be open to constructive criticism, of course, but a lot of the hate you'll hear is bullshit.
So it's not peer pressure, we actually have data to back this up, and if you think about it, the whole thing boils down to motivation. Sure, you can write secure and insecure code as well in any language/environment. But defaults are powerful, and it makes me feel sad every time I have to write in reports that "you should've paid attention to opt-in to the secure solution every time you do X" vs. when we do demos to developers and we have to work really hard to disable every protection built into ASP.NET. (And no, I don't like Microsoft at all.)
* Did they support EOL'd versions of PHP?
* Are they legacy WordPress/Drupal/Joomla projects that haven't been updated in years?
* Are they in the "we (didn't use a framework|rolled our own framework) and used the mysql_* functions" league?
* Did they attempt to do something weird/crazy (i.e. store all session state in an encrypted cookie instead of server-side like normal, but forget to authenticate the ciphertext)?
Those are the kinds of things that I rarely find in modern PHP projects.
One thing I think Evert neglected to mention in his post: There's definitely an ecosystem problem. Incidentally, I've been working on cleaning it up on multiple fronts:
* Improving the quality of information developers will find via Google search or StackOverflow
* Writing blog posts that address security concerns e.g. https://paragonie.com/blog/2016/02/how-safely-store-password...
* Improving the security of the tools and frameworks developers use
* Working to improve the language itself (part of the reason why PHP 7's CSPRNG functions don't fail open is because a few of us were very vocal on how/why that would harm security)
Frameworks were sometimes used, although their effect on security is somewhat baffling at first sight -- and this is regardless of the platform, although we found most issues with PHP and J2EE. Sure, when you use the framework for security-critical things such as constructing SQL queries (SQLi) or HTML output (XSS), things work quite well. However, since most developers don't think about these issues, the single time they have to "escape" from the framework, since it doesn't (or they just think it doesn't) support a certain scenario, they don't know about all the things PHP and in smaller ways, J2EE requires to do for security.
Of course, this way, the framework protects 9x% of the application, but the asymmetry of security is that the attacker only needs a single vulnerability while the defender must patch it all.
I'm not surprised to hear that custom-made business applications fared so poorly. Back when I worked for a telecommunications company, I saw some of the worst code imaginable endorsed by corporate and deployed to production with wild abandon. I reported no less than 10 vulnerabilities in my first day with a new codebase and they were all ignored. My boss took me aside and said, "There's some politics going on right now, just keep that in your back pocket in case you need to bring it up later. Now's not the time."
> ... And to anyone considering programming as a career, or trying to get into it… stay away from PHP. There’s lots of fun, interesting languages out there that also get the job done quick, but with a better reputation and this will have an actual effect on your future career options.
> Looking for a PHP developer for your next project? I'm looking for work! Check out my resume or drop me a line!
I don't think you can argue it's just an opinion. I haven't seen anyone argue that php isn't badly designed or implemented. Other than stating that it works and you can work around it.
What we found is that most good programmers didn't want to work in php and most php developers were designers that learned how to code php. But they didn't understand CS fundamentals or even a decent idea how to code. They could cobble together a web site that worked and even looked great, but they didn't know how to write maintainable, modular code.
It got to the point where I would ask the candidate to merge two sorted arrays and 70% couldn't do it properly.
In terms of language, I thought php itself was a surprisingly productive language. I just quit though because I didn't want to be known as a php developer because of the stigma and there poor quality of other php developers that I encountered.
Perhaps remembering that PHP could mean "PHast Prototyper" could help you/your team come to terms with all this?
The HN post title is sure helping with the reputation.
All trendy technologies might be replaced anytime (hey React, Go, I'm looking at you!), one day they are very cool, the next day nobody maintains them and everyone talks about another new cool thing; how many of these have we seen?
New cool stuff are important to know, explore, test, use because they bring a lot of interesting stuff, but often they only address some use cases, as they have been made by a team with specific needs (looking at all hundreds NoSQL databases?); php and some others (like ruby) are stable, well known, cover a vast area of use cases with very well made and long thought frameworks and tools (symfony, doctrine, phpstorm, ...).
You are always free to follow trends, like with clothes, or just choose the best thing for what you need to do. You'll definitely find jobs with any of these, if you are able to explain why they are good for what you are doing.
Once you need a framework and the complexity that goes with it, PHP starts to suck. It lacks the behavior and tools to nicely manage complexity beyond a pile of files.
But when what you need is a pile of files, PHP is awesome.
The day a languages appears that is web-ready and dead-simple with no technical debt that's the day we can say: PHP Suck.