What exactly does this definition (”related to”) mean? Note your excerpt doesn’t say vulnerabilities in PHP so these are probably vulnerabilities associated more closely with software written in PHP rather than defects in the language itself - software written by developers who are inexperienced in writing secure webapps and like to name their projects phpThis and phpThat.

Either which way it is good to read that the Scan Report on Open Source Software 2008 ( scan.coverity.com and also mentioned on http://www.zdnet.com.au ) commends the PHP developers for elimination of “multiple classes of potential security vulnerabilities” from their code.

From en.wikipedia.org
The proportion of vulnerabilities related to PHP, out of the total of all common vulnerabilities, amounted to: 12% in 2003, 20% in 2004, 28% in 2005, 43% in 2006, 36% in 2007, and 33.8% for the first quarter of 2008.

PHP in many ways, really does suck. The apparent counter argument that Perl is difficult to install however is utterly redundant - the fact is that the obvious problems with PHP just shouldn’t be there any more. Unfortunately backwards compatibility seems to be a higher priority than a clean API. I have some stong opinions about that, unfortunately I don’t think airing them will make the blindest bit of difference.

The language itself is inherently easy to learn, therefore the barrier to entry is lower than most others. This inevitably means a large proportion of new programmers end up learning how to code using it. There are a lot of very poor developers in the PHP community. There is no denying that. A lot of it comes down to the fact there is no one single well defined way of working with the platform. A good education goes an awful long way in that regard.

It still flummoxes me however as to why people assume that this must mean the language itself is flawed. It’s a logical syntax construct, just like most others. It can do the same things the others can (for the most part). Any bad code written using it simply means the person responsible for developing it has not learnt his craft. There are VERY few situations where PHP simply cannot complete a task that another language can. I can think of a couple off hand, however both of those are related more to the webserver the language runs within as opposed to the language itself.

I use PHP daily for my projects (of which many are on a pretty substantial scale) entirely of my own choice. And whilst there are numerous annoying quirks I’ve had to spend time adjusting to over the years, I still die a little inside when I have to go and try and build the same kind of systems in other languages. The time spent just writing variable declarations in some languages is time I could have spent writing something useful. And then it comes to deployment and things get really interesting. (Don’t get me wrong, some languages are very human friendly in the syntax department.. I’m just making a point!)

But I digress. PHP was built to do a pretty specific job. No matter how you look at it, it does it as well or better than pretty much anything out there, so long as what it’s being told to do actually makes sense in the context. The term “garbage in, garbage out” applies to just about anything you can turn your hand to, and this is no different.

In an ideal world, the whole PHP api would be object oriented, the whole global space would be all but scrapped, the concept of errors would be entirely replaced with exceptions and there would be a mechanism for defining your own syntax structures. Ah, if only time grew on trees, I’d be tempted to do it myself, heh.

Seriously, isn’t this post the exact opposite of the “PHP-sucks” posts? And thus isn’t it as lame as all the others?

If any one can really say a language sucks may be you need to check yourself if you understand the purpose for the particular programming language. I use a lot of different languages for various reasons , one has to understand the project requirements and the limitations for the language.

Try to burn a dvd with your cd-rom(90x) and tell me after if you still think highly of your cd-rom….

I have been using PHP for over 10 years now, and I know ColdFusion, .NET and Java as well personally I prefer PHP, why because its free, lightweight, doesnt need to be compiled and does everything I need it to and more.

The naming conventions on some PHP function are a little out of whack. To this day I still have to RTFM to find a function I am looking for, but that can also be fixed with an IDE that has code completion.

For anyone to say say that something sucks as a language is bad. I would stab my eyes out the day that I have to write something in assembly but I am not going to turn around and say that it sucks as a language.

PHP cant possible be as bad a the nay sayers say it is or yahoo wouldn’t be using it and Zend wouldn’t have backed it and the 20+ trillion domains that are using it wouldn’t be using it.

But if your entire piece is that PHP sucks, period, with no context, with no real insight, then that post is worthless.

That’s the division. Certainly, I’m not suggesting that criticizing ANY language automatically qualifies you as some sort of problem.

Sounds like sound reasoning to me.

::rolls eyes::

It’s classic. I love comments like this: “PHP is a bad language. PHP sucks..” All talk, no context. Reddit postings somehow increase their level of suckage on a daily basis.

Based on repeated experience, I have decided that PHP causes brain damage. Sure, you can find smart PHP developers if you look hard enough. Sure, you can find well written PHP apps if you look hard enough. But that isn’t the ecosystem that has developed around PHP. Most PHP developers are rank amateurs that think MVC is a nice idea but unrealistic, wouldn’t know SQL injection if it bit them, fondly remember register_globals and think XSS is CSS mispelled. They may earn a living coding PHP, but they’re amateurs.

Yes, PHP is moving away from that past. Maybe things will be better three or four years from now. But the present reality is that PHP has spent nearly a decade nurturing bad habits. I mean come on, addslashes?! What’s that about? It’s begging developers to write things the wrong way.

If you’ve got a site that needs some basic content management and a mail form, then I don’t think there are many tools that are better for the job. Using PHP you could probably hack it together in an afternoon.

However, I’d be hesitant to use it on anything much larger then that these days. Once you get to bigger projects (a more complex CMS, web applications, etc) then you quite quickly end up with an umanageable application.

I know there are ways to avoid that, and several frameworks are gaining traction, but I still feel there’s too many wheels being invented around the PHP world, because people have some (generally very minor) issue with the other frameworks, and build a new one.

The Zend Framework might help that, but only if some best practices are built around it, as opposed to the current situation of “here’s a bunch of components… just, you know, bolt them together how you like”. I’ve seen too much badly written, unmaintainable PHP to get behind that sort of attitude.

Still, as somebody who currently has to do maintanence on a Perl web application (albeit a well designed one), I’d rather have a PHP app to work on!

That’s an interesting position to take. Most of the PHP bashers that I know have used it far too much and are used to languages that give even more freedom than PHP.

My personal gripes with PHP come from the language always getting in my way when trying to accomplish something. It’s the little things like inconsistent naming (or worse, inconsistent parameter order within function families) and missing concepts (like closures) that I use all the time in other languages that add up to a big heap of no-fun. Other things that bug me about PHP aren’t so much language issues as they are culture issues. The “PHP community” seems very fractured and disconnected.

But it’s getting there. PHP seems to be asymptotically approaching the other dynamic languages in terms of community and unctionality, so one day they’ll all be the same modulo syntax

I know php is a good choice actually better then java and asp if all you want is web application, or web front for a big java or .net app running on server.

Just read your response. In re-reading what I posted, it’s a little obvious that I had just been reading a George Carlin book, because I’m a little more acerbic than usual.

That said, I’ve read through your site, and it’s nice to read discussion and not have it be “PHP sucks” with no actual reasoning other than the same recycled rigamarole.

You said: “Sometimes that right tool for the job just happens to be a crappy language.”

Whether it actually is crappy or not doesn’t automatically make it the wrong tool for everyone. I can use a great language and still write crappy code. And If I can write secure code quickly in PHP and don’t hit the “limits” that so many complain about, I can’t categorize it as an awful language. But I respect your right to choose not to code in it and feel any way you want about it.