PHP 8.5

PHP is a very pleasant and straight-forward language to work with. I enjoyed my time working with it, though I did also see quite a lot of very poor code.

I think the danger with PHP is more its ability to easily cause *very bad things*.

This would partially be poor training (my University literally taught PHP with SQL-injectable examples), and I think the language itself making it very easy, such that less-experienced developers using it - most of them, early on - don't realise what's wrong until it's gone wrong.

With PHP being such an early tool online, and the above properties existing, it earned a reputation for being insecure and bad.

> I think the danger with PHP is more its ability to easily cause very bad things.

Is there any language where you can't?

Probably not, but not most languages are not inviting to do them.

Give me an example where PHP invites developers to do terrible things and I'll show you 2 other popular languages that invite equally bad or worse things :)

Or as Bjarne Stroustrup put it: There's two types of languages: The ones people complain about and the ones noone uses

It's like walking on minefields with very different "mine densities"; when using something stricter, you would have one mine per acre, with PHP you would have ten.

For the longest time the language had been developed with this mentality that it's okay to continue running if something broke, that it's better to print out something than to do nothing and bail out.

Which means that for things to run reliably, you have to write very defensive code that checks everything you can think of. Which is probably a good idea with any language, but I find that old PHP requires much more of this.

Thankfully, they've been changing that over the past decade while still maintaining decent compatibility with old code. I just recently finished porting a pretty large project (~2 mil SLoC) from the ten year old 5.6 to the currently latest 8.4, and it's been pretty painless. The only things that broke were those that were never actually properly implemented and worked by pure chance.

At least in my experience, the early years of PHP was lacking more enterprisey users; back then there was a small revolution when RoR came out and introduced the MVC pattern to a lot of (web) developers, who didn't have as opinionated a pattern / architecture up until then.

During that same period, there were a lot of mediocre tutorials and documentation online, including on the PHP website itself which allowed people in comments to post code examples, but as far as I know there wasn't a lot of moderation on those.

And finally, a lot of people ended up writing their own frameworks and the like, because they could. But also because there weren't any or not many good and widely adopted frameworks out there, that came later with first Zend Framework and then Laravel, the latter being the de-facto standard nowadays.

You can do crazy things in every language. However, in a language like Java, the crazy things are more conceptual (factory for factory of factories) and not basic things like what does == mean or problems with weak typing and implicit conversions. A lot of the issues with PHP can be avoided in modern PHP using things like strict_types=1, but most of the time, we don't get to work with projects using best practices. And I'd rather work with a bad Java project than any bad PHP project (which I have had the misfortune of maintaining).

Funny that you picked == as an example when == is very counter intuitive in Java and is one of the common pitfalls for beginners:

    String a = new String();
    String b = new String();
    a = "test";
    b = a + "";
    
    if (a == "test")
    {
        // true
    }

    if (b == "test")
    {
        // false
    }

    if (a == b)
    {
        // false
    }
        

Just like PHP, you have to read the docs to use it properly.

This is a decade-old PHP defence fallacy. No one says other languages have no problems, so "disproving" that is the fallacy. PHP just has far more problems and footguns. Maybe now it has fewer, but still. Far more.

The @ operator of php. In languages like Java, to silently catch all exceptions and do nothing with them requires at least some boiler plate.

PHP has an operator for something you should never do in a sane codebase.

You know that python wants good good to look good?

PHP was written in a way that makes bad code look good. And if we want Software Engineering to be a serious field that evolves, we have to be able to be honest with ourselves. It is a bad tool. Good programmers can even write good programs with bad tools. Doesn't mean you shouldn't avoid bad tools given the option.

There probably is a "PHP the good parts". But Javascript actually had a pretty nice core, and an utility of being in all web browsers that no other language could replicate. What niche does PHP have where it brings more value there other nicer languages can't be used instead?

So you're going to ignore the rest of what I wrote? I'll just assume you agree with me and the rest of my comment, but you don't want to admit it. Works for me.

You absolutely can use @ in sane codebases. And you give the example yourself: In other languages you often enough see that boilerplate where thrown exception is discarded, because there is no sane reaction to some edge case and you just want the program to continue, because you know it will work anyway. And that's @.

Note though that @ was already neutered in some earlier recent PHP releases.

The claim was "PHP invites bad code" - but your point is for "bad code can be written in PHP" which is really not the same thing. A quick google for the @ brought up https://stackoverflow.com/questions/136899/suppress-error-wi... where the highest voted response is ~"NO, don't use it please". No use case I've come across during the past 10 years has required or even nudged me in the direction of @. It's an ancient relic that the whole community considers a no-no. I'd be curious if you really want to argue that this state of affairs "invites" using the @.

This.

One common use case for the @ operator, is when "destructuring" array members into variables. In some cases, you can't know if the member will be available, but it's not important if it's missing. In that case, you can silence the warning.

$array = ['apple', 'pear']; @list($mainFruit, $secondaryFruit, $tertiaryFruit);

Since I suppress the warning that would occur due to the third member not being present, the program will continue executing instead of halting.

> The @ operator of php. In languages like Java, to silently catch all exceptions and do nothing with them requires at least some boiler plate.

The @ operator doesn't get rid of exceptions it get rids of "warnings" which are basically built in log messages.

It used to get a bad wrap for also silencing fatal errors, but it stopped doing that a while ago.

The @ operator is something that should only be rarely used, but it is no way comparable to catching exceptions and doing nothing with them. There are sane uses for it.

I miss doing drive-by SQL injection attacks against my classmate's string concatenations with bonus no input validation queries