What’s wrong with PHP - wisdom from… a slashdot comment?!?
rzwitserloot posted in programming on November 6th, 2006

I found this slashdot comment, posted by a manager that uses PHP a lot. It states, very eloquently, what’s wrong with PHP specifically, and a general way of thinking about programming in general that he calls the ‘works for me’ ethic.

In addition, it includes a number of solid observations about the validity, or lack thereof, on emotional reactions to programming language discussions. There have been certain insinuations I engage in such practices, so perhaps it might be of interest

Link to the slashdot comment.

Copy of the comment reproduced below the break.

Urbanradar,

Your comment pisses me off, but there’s something I want to say all the same: I think you are, essentially, right. Whatever one’s woes with PHP might be, they don’t justify trolling and unsubstantiated mouthing off. Besides, “toy language” is a purely inflammatory statement that doesn’t even have any factual content.

However.

However, the implicit underlying assumption I think I perceive in your comment — that PHP criticism must be trolling — annoys me a lot. Please allow me to expand on this.

You see, one constant characteristic of the Internet in general is the noise. Look here on Slashdot: do you read all the comments on any given story?

The noise is a bigger problem than you’d think. The noise means that it’s hard to get heard. It means that to be heard, unless you’re a remarkable writer (which I, and most people, aren’t), you have to exaggerate your message. “PHP is a toy language” is one such exaggeration; and perhaps even actually worthy of being modded up if followed with factual information to support it. And much likelier to catch a moderator’s attention with its use of strong language.

Which you would, undoubtedly, consider a troll all the same, wouldn’t you?

As you can probably guess by now, I have crates of such information against PHP. (In my defense, I do try hard to gather evidence against my own tools of choice as well, for two reasons. One, being aware of their own idiosyncrasies allows me to work better with them. Two, it’s a simple matter of intellectual honesty.)

The vagaries of life have landed me into a managerial-ish position in a small company that develops and hosts large-scale PHP websites. My responsibility here is twofold: ensuring that the sites work, and ensuring that they keep working.

I didn’t know PHP before joining this company; I had a generally positive opinion of it beforehand, from reading Slashdot. So I got to discover it through that new role.

Let us just say, to put it mildly, that my opinion of PHP has quickly become very poor.

I think that managing a language’s design and development is one of those jobs that’s freaking damn hard. It takes a LOT of experience, critical thinking, introspection, knowing to prioritize issues, knowing to tap into the decades of experience in language design to understand what works and what doesn’t, why, and in what context. And different people with different backgrounds and objectives are more or less successful with it.

And I don’t feel the people behind PHP — I’m sorry, guys, I don’t know how to put it nicely… — are doing the best possible job of it.

More precisely, my primary issue with PHP is its culture as a project. Cultures are inherently difficult to describe, but if I had to put it in a few words, I’d call it the “Works for me” culture.

Simply put, the sort of attitude that PHP seems to encourage — by which I mean, the shortest-path-to-arrival approach to doing most things in PHP — work fine for the developper producing the code, but are formally broken in a way that WILL come back to bite the ass of whomever poor dude is in charge of keeping the thing working.

For instance: I understand PHP uses a function based on the tolower() C call to make method calls case insensitive, and leaves it at it. It works for them, doesn’t it? Except that in the real world, it breaks. Deploying PHP sites on servers that use a Turkish locale yields blank pages. The workaround is to never use that particular locale. Easy, isn’t it? No, it isn’t: PHP’s gettext functions for dynamic translation require the locale to be set appropriately (unlike that of other languages). And I have my Turkish clients on the phone a lot.

Until recently, before the introduction of PDO, the canonical native way of addressing databases was to use PHP functions named after the database itself (mysql_*, etc, making the process of migrating databases, or creating a site that may have to be deployed client-side on varying database backends, an utter pain. The current canonical way still doesn’t proactively encourage the use of prepared statements, that would yield better performance and forbid entirely SQL injection attacks. (But the current way “works for me”, doesn’t it?)

PHP STILL doesn’t have namespaces. Why does this matter? Well, for instance, had PHP put the HTTP request data into its own namespace, the whole register_globals debacle wouldn’t even have been possible. Good engineering practices are no silver bullet, but they do ensure that whole classes of problems simply can’t happen. I think this is why the “Works for me” culture tends to fosters projects (and I don’t mean only PHP, here, mind) with recurrent security issues.

Unicode support has been problematic; and by this I mean I have two major problems with it. Firstly, the lack of a native Unicode type means you can’t carry around a known-good string that you can pass around or retrieve from an third-party, and only convert back to the requested encoding. Why does this matter? Well, most PHP functions break hard on UTF-16 encoded byte arrays, which contain zeros. Secondly, whenever you raise this issue, the common answer is, “What’s wrong with the mbstrings functions?” And THIS is what I mean by a cultural issue: the assumption that because mbstrings “work for me”, they’re a suitable solution. This is not a technical problem at heart, folks.

And there’s the problem of backward compatibility, which is never a granted, and makes the job of keeping production servers up to date a nightmare. There’s thread safety, there’s syntax bone-headedness that probably stems from PHP’s lack of a grammar, there’s the inconsistent behavior depending on server-side settings that you may have no control on, etc, etc, etc.

All of those make the management of large-scale PHP projects an incredible pain, and it’s all the more embittering that a large chunk of it could be abated by good freaking engineering practices.

I think this is what people mean when they call the management and design of the PHP language ‘amateurish’. Blatant lack of good engineering practice. I do disagree with the word amateurish itself, though: the fine guys over at Zend are professionals, and making good money off their language, which is one of the most widely deployed on Web servers. They’re without contest professionals. Just, professionals with poor engineering practices.

The thing I can’t forgive PHP, however, is that due to the way it encourages and rewards (at first) shortest-path-to-arrival approaches, it teaches beginning programmers everywhere that it’s okay so long as it “works for me”. That it’s okay not to care about good practices so long as it works. That it’s okay to embed SQL requests right in the HTML templates. And, due to PHP’s lack of introspection and metaprogramming, that other approaches are a lot more work and not worth it.

And THIS is what people mean when they unleash Dijkstra’s ghost onto PHP.

Granted, designing a language where the easiest way to do anything is correct and robust one, while keeping the flexibility and development speed of an interpreted and dynamically typed language, is extremely difficult. Is that any reason not to try, though?

So, yes, after more hours of nightly overtime than I care to count, after salvaging several expensive PHP projects for large companies that where unmanageable messes, I’ve come to hate PHP, which I consider a character flaw in me. PHP is just a language; that should warrant an informed opinion — which I like to think I have — but not an emotional reaction.

And this, in the end, is why I wanted to post this: your comment annoys me a lot, but I think its sentiment is, at heart, correct: emotional reactions to technical issues shouldn’t supplant informed discussion.

And this goes both for the PHP-hater and the PHP-lover side.

Thanks.

Written by: ‘Balinares’ on slashdot.