PHP - my experience - Dr. Andrew J. Page

Wednesday, July 13. 2005

PHP - my experience

In reply to Des and Daves excellent posts about PHP, I would like to share my own experiences.

Over the past few years I have used php extensively when I was working on politics.ie. I've dissected phpNuke with an M60, have hacked serendipity to shreds, bet phpBB into shape and clobbered MediaWiki with a sledgehammer. These are all very large open source software projects which are based on PHP and all of them are very badly coded and messy. Over the past few months phpBB has had to release a number of updates ( some major) to fix critical security bugs. Most of these bugs wouldn't have occurred in other languages, such as Perl, and are simply as a result a poor language.

URL variables

Consider this: You can set variables simply by putting them in the url. PHP programmers also carelessly use the global variables feature of PHP, which allows you to set variables in one script and include them in another. PHP programmers also don't initialize variables (sure whats the point?). So you can set variables externally if the programmer has been careless. This is a fundamental problem with PHP and I have seen dozens of attacks on phpNuke, and phpBB which exploit this. Once they gain a foothold they either use an SQL injection attack to mess up your database or they install a PHPshell which allows them to execute arbitrary commands as the account which runs the PHP script. Many then setup IRC servers and can be used as zombies, or they run kernel exploits. The ability to pass in arbitrary information into variables is dangerous and is not needed unless its being run on a machine on you are going to use. Variables should only take external input when its expressly requested, not by default.

Separation of code and HTML

Unfortunately for very large projects PHP code and HTML gets completely intermingled no matter how good a (nonstandard) PHP templating system your using. Programmers get lazy, or use different styles. For example do you make the whole script PHP code and print/echo (why have 2 commands doing the same thing?) HTML? or do you have the whole script HTML with only where its needed. From the large PHP projects I've had misfortune to have to hack, both conventions are used extensively within projects.

Mambo

Mambo is a classic PHP content management system. It is also very very poorly coded. What you wont find anywhere in the documentation for this software is that you shouldn't put more than a few hundred articles into it, or it falls very and dies a very horrible death. From having looked at the source extensively, its comes down to poor MySQL and very poor PHP. On the MySQL side of things they don't use the "Limit" keyword to prevent too many results from being returned. For example I put 6500 articles ( each about 500 words average) into it, and most features die, because PHP runs out of memory when MySQL returns 6500 articles. The programmers should have factored this in (this is not limited to PHP). But the way in which the whole thing was coded meant that to fix these inherent problems would require a major rewrite.

OO vs procedural

All of the large PHP projects I have hacked are procedural rather than OO. They will have multiple large files of code, many of which are included (linearly) and have functions. Its exceptionally rare that you will see a proper object and methods on that object being called. The only time seems to be for SQL query's, but even then its different for different parts(some functional) of the same piece of software. This is a very big short coming in PHP, and it will take a lot of head banging to get current PHP programmers to switch to a better, more scalable, way of writing software. They should either code properly in a C style or an OO style, but not a mishmash of both with 1st year layout thrown in. Otherwise these projects are doomed in the long run, with very high maintenance and many many more security holes.

Posted by Andrew Page in Opinion at 13:24 | Comments (2) | Trackback (1)

Trackbacks

Trackback specific URI for this entry

PHP
Des explains his dislike of PHP. I don't have enough experience with PHP to give any kind of definitive opinion on this one, but here's a few points; Based on personal experience, I'm suspicious of PHP. On the one hand, I've seen some impressive stuff

Weblog: Charlie Don't Surf
Tracked: Jul 14, 02:57

Comments

Display comments as (Linear | Threaded)

So let me get this straight because there are bad programmers out there the software is bad?

Since you can hammer a screw in is that the hammers fault or wait maybe it's the screws. Actually it's neither it's the fool trying to hammer in a screw.

Just because something can be used on way does not make it bad.

I agree that some of the loose coding that get's done with PHP is a problem however think of all the people that take advantage of the fact that PHP is quick to learn. It's like Othello in that matter, a minute to learn a lifetime to master.

For someone who sounds so against php it's rather weird that your blog software would use it, because surely as skilled a programmer you are you could use another language.

I use PHP and ASP in my daily life and I enjoy the easu of use for both of them and while I can be lazy with some of my programming it is up to me to ensure the safety of my app - the same as any other language.

#1 Rick on 2005-07-15 14:36

I'd agree with Rick for the most part, but there are a few things about PHP that really irritate me. Lack of backward compatibility being the first, frequent secruity holes being the second.

It was my original rant about PHP that caused these other articles, but I do stand by what I said there. I'd also point out that PHP tends to teach bad habits first, then hopes you'll learn better.

All that said, there are some great free web applications written in PHP, this blog for example, phpbb, and others.

#2 Des on 2005-07-17 12:21

The author does not allow comments to this entry