This is true, except that PHP gets in your way if you want to do a solid job.

You can never code a PHP app securely and quickly.

1. It is broken by design, and will never be fixed. Most of these are caused by cowboy development and adding in features too late, ex unicode, namespaces, and exception handling. These will also be problematic because the 1000′s of functions stuck in the global namespace(lulz) will never support unicode and exceptions 100%. Never

2. The PHP team does not and never will take security seriously. Even well written and though out(lol) PHP is always vulnerable to issues built into the language.

3. For any problem domain, you can easily find something that does it better.

The only possible valid use for PHP is if you have nothing but static html pages and a few of them need a minor amount of dynamic content. Any other use is invalid and this use case is better served by Perl, Python, Ruby, Ajax on the front-end and anything(except PHP) on the backend.

It has no place, and if you can’t accept it, then at least accept that you are part of the problem.

What exactly does this definition (“related to”) mean? Note your excerpt doesn’t say vulnerabilities in PHP so these are probably vulnerabilities associated more closely with software written in PHP rather than defects in the language itself – software written by developers who are inexperienced in writing secure webapps and like to name their projects phpThis and phpThat.

Either which way it is good to read that the Scan Report on Open Source Software 2008 ( scan.coverity.com and also mentioned on http://www.zdnet.com.au ) commends the PHP developers for elimination of “multiple classes of potential security vulnerabilities” from their code.

From en.wikipedia.org
The proportion of vulnerabilities related to PHP, out of the total of all common vulnerabilities, amounted to: 12% in 2003, 20% in 2004, 28% in 2005, 43% in 2006, 36% in 2007, and 33.8% for the first quarter of 2008.

PHP in many ways, really does suck. The apparent counter argument that Perl is difficult to install however is utterly redundant – the fact is that the obvious problems with PHP just shouldn’t be there any more. Unfortunately backwards compatibility seems to be a higher priority than a clean API. I have some stong opinions about that, unfortunately I don’t think airing them will make the blindest bit of difference.

The language itself is inherently easy to learn, therefore the barrier to entry is lower than most others. This inevitably means a large proportion of new programmers end up learning how to code using it. There are a lot of very poor developers in the PHP community. There is no denying that. A lot of it comes down to the fact there is no one single well defined way of working with the platform. A good education goes an awful long way in that regard.

It still flummoxes me however as to why people assume that this must mean the language itself is flawed. It’s a logical syntax construct, just like most others. It can do the same things the others can (for the most part). Any bad code written using it simply means the person responsible for developing it has not learnt his craft. There are VERY few situations where PHP simply cannot complete a task that another language can. I can think of a couple off hand, however both of those are related more to the webserver the language runs within as opposed to the language itself.

I use PHP daily for my projects (of which many are on a pretty substantial scale) entirely of my own choice. And whilst there are numerous annoying quirks I’ve had to spend time adjusting to over the years, I still die a little inside when I have to go and try and build the same kind of systems in other languages. The time spent just writing variable declarations in some languages is time I could have spent writing something useful. And then it comes to deployment and things get really interesting. (Don’t get me wrong, some languages are very human friendly in the syntax department.. I’m just making a point!)

But I digress. PHP was built to do a pretty specific job. No matter how you look at it, it does it as well or better than pretty much anything out there, so long as what it’s being told to do actually makes sense in the context. The term “garbage in, garbage out” applies to just about anything you can turn your hand to, and this is no different.

In an ideal world, the whole PHP api would be object oriented, the whole global space would be all but scrapped, the concept of errors would be entirely replaced with exceptions and there would be a mechanism for defining your own syntax structures. Ah, if only time grew on trees, I’d be tempted to do it myself, heh.

Seriously, isn’t this post the exact opposite of the “PHP-sucks” posts? And thus isn’t it as lame as all the others?

If any one can really say a language sucks may be you need to check yourself if you understand the purpose for the particular programming language. I use a lot of different languages for various reasons , one has to understand the project requirements and the limitations for the language.

Try to burn a dvd with your cd-rom(90x) and tell me after if you still think highly of your cd-rom….

I have been using PHP for over 10 years now, and I know ColdFusion, .NET and Java as well personally I prefer PHP, why because its free, lightweight, doesnt need to be compiled and does everything I need it to and more.

The naming conventions on some PHP function are a little out of whack. To this day I still have to RTFM to find a function I am looking for, but that can also be fixed with an IDE that has code completion.

For anyone to say say that something sucks as a language is bad. I would stab my eyes out the day that I have to write something in assembly but I am not going to turn around and say that it sucks as a language.

PHP cant possible be as bad a the nay sayers say it is or yahoo wouldn’t be using it and Zend wouldn’t have backed it and the 20+ trillion domains that are using it wouldn’t be using it.

But if your entire piece is that PHP sucks, period, with no context, with no real insight, then that post is worthless.

That’s the division. Certainly, I’m not suggesting that criticizing ANY language automatically qualifies you as some sort of problem.

Sounds like sound reasoning to me.

::rolls eyes::

It’s classic. I love comments like this: “PHP is a bad language. PHP sucks..” All talk, no context. Reddit postings somehow increase their level of suckage on a daily basis.

Based on repeated experience, I have decided that PHP causes brain damage. Sure, you can find smart PHP developers if you look hard enough. Sure, you can find well written PHP apps if you look hard enough. But that isn’t the ecosystem that has developed around PHP. Most PHP developers are rank amateurs that think MVC is a nice idea but unrealistic, wouldn’t know SQL injection if it bit them, fondly remember register_globals and think XSS is CSS mispelled. They may earn a living coding PHP, but they’re amateurs.

Yes, PHP is moving away from that past. Maybe things will be better three or four years from now. But the present reality is that PHP has spent nearly a decade nurturing bad habits. I mean come on, addslashes?! What’s that about? It’s begging developers to write things the wrong way.

If you’ve got a site that needs some basic content management and a mail form, then I don’t think there are many tools that are better for the job. Using PHP you could probably hack it together in an afternoon.

However, I’d be hesitant to use it on anything much larger then that these days. Once you get to bigger projects (a more complex CMS, web applications, etc) then you quite quickly end up with an umanageable application.

I know there are ways to avoid that, and several frameworks are gaining traction, but I still feel there’s too many wheels being invented around the PHP world, because people have some (generally very minor) issue with the other frameworks, and build a new one.

The Zend Framework might help that, but only if some best practices are built around it, as opposed to the current situation of “here’s a bunch of components… just, you know, bolt them together how you like”. I’ve seen too much badly written, unmaintainable PHP to get behind that sort of attitude.

Still, as somebody who currently has to do maintanence on a Perl web application (albeit a well designed one), I’d rather have a PHP app to work on!