Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
Search - "php include"
-
Oh, man, I just realized I haven't ranted one of my best stories on here!
So, here goes!
A few years back the company I work for was contacted by an older client regarding a new project.
The guy was now pitching to build the website for the Parliament of another country (not gonna name it, NDAs and stuff), and was planning on outsourcing the development, as he had no team and he was only aiming on taking care of the client service/project management side of the project.
Out of principle (and also to preserve our mental integrity), we have purposely avoided working with government bodies of any kind, in any country, but he was a friend of our CEO and pleaded until we singed on board.
Now, the project itself was way bigger than we expected, as the wanted more of an internal CRM, centralized document archive, event management, internal planning, multiple interfaced, role based access restricted monster of an administration interface, complete with regular user website, also packed with all kind of features, dashboards and so on.
Long story short, a lot bigger than what we were expecting based on the initial brief.
The development period was hell. New features were coming in on a weekly basis. Already implemented functionality was constantly being changed or redefined. No requests we ever made about clarifications and/or materials or information were ever answered on time.
They also somehow bullied the guy that brought us the project into also including the data migration from the old website into the new one we were building and we somehow ended up having to extract meaningful, formatted, sanitized content parsing static HTML files and connecting them to download-able files (almost every page in the old website had files available to download) we needed to also include in a sane way.
Now, don't think the files were simple URL paths we can trace to a folder/file path, oh no!!! The links were some form of hash combination that had to be exploded and tested against some king of database relationship tables that only had hashed indexes relating to other tables, that also only had hashed indexes relating to some other tables that kept a database of the website pages HTML file naming. So what we had to do is identify the files based on a combination of hashed indexes and re-hashed HTML file names that in the end would give us a filename for a real file that we had to then search for inside a list of over 20 folders not related to one another.
So we did this. Created a script that processed the hell out of over 10000 HTML files, database entries and files and re-indexed and re-named all this shit into a meaningful database of sane data and well organized files.
So, with this we were nearing the finish line for the project, which by now exceeded the estimated time by over to times.
We test everything, retest it all again for good measure, pack everything up for deployment, simulate on a staging environment, give the final client access to the staging version, get them to accept that all requirements are met, finish writing the documentation for the codebase, write detailed deployment procedure, include some automation and testing tools also for good measure, recommend production setup, hardware specs, software versions, server side optimization like caching, load balancing and all that we could think would ever be useful, all with more documentation and instructions.
As the project was built on PHP/MySQL (as requested), we recommended a Linux environment for production. Oh, I forgot to tell you that over the development period they kept asking us to also include steps for Windows procedures along with our regular documentation. Was a bit strange, but we added it in there just so we can finish and close the damn project.
So, we send them all the above and go get drunk as fuck in celebration of getting rid of them once and for all...
Next day: hung over, I get to the office, open my laptop and see on new email. I only had the one new mail, so I open it to see what it's about.
Lo and behold! The fuckers over in the other country that called themselves "IT guys", and were the ones making all the changes and additions to our requirements, were not capable enough to follow step by step instructions in order to deploy the project on their servers!!!
[Continues in the comments]26 -
The gift that keeps on giving... the Custom CMS Of Doom™
I've finally seen enough evidence why PHP has such a bad reputation to the point where even recruiters recommended me to remove my years of PHP experience from the CV.
The completely custom CMS written by company <redacted>'s CEO and his slaves features the following:
- Open for SQL injection attacks
- Remote shell command execution through URL query params
- Page-specific strings in most core PHP files
- Constructors containing hundreds of lines of code (mostly used to initialize the hundreds of properties
- Class methods containing more than 1000 lines of code
- Completely free of namespaces or package managers (uber elite programmers use only the root namespace)
- Random includes in any place imaginable
- Methods containing 1 line: the include of the file which contains the method body
- SQL queries in literally every source file
- The entrypoint script is in the webroot folder where all the code resides
- Access to sensitive folders is "restricted" by robots.txt 🤣🤣🤣🤣
- The CMS has its own crawler which runs by CRONjob and requests ALL HTML links (yes, full content, including videos!) to fill a database of keywords (I found out because the server traffic was >500 GB/month for this small website)
- Hundreds of config settings are literally defined by "define(...)"
- LESS is transpiled into CSS by PHP on requests
- .......
I could go on, but yes, I've seen it all now.12 -
Hello there, just couple of words about PHP. I've been develop on PHP more than 10 years, I've seen it all 3,4,5,{6},7. Yes PHP was not good in terms of engineering and patterns, but it was simple, it was the most simple language for web to start those days. It was simple as you put code into file, upload it via FTP and it works. No java servlets, no unix consoles, no nothing, just shared hosting account was enough to host site, or even application with database. As database everybody used to have mysql, again because its simple to start and easy to maintain. So PHP+MySQL became industry standard on Web during 00-2012, and continues in some way.
You can write HTML and logic inside single file, within php code, even more single file may content few pages, or even kind of framework. That simplicity and agility sticks everybody who wants to develop sites with PHP.
This is pretty much about why it is so popular.
Each good or wannabe PHP developer in an early days write its own framework or library (like in javascript this days because of nodejs)
Imagine that PHP has hadn't have package manager, developers used to have host packages on their own sites, then various packages catalog sites created, and then finally composer. A gazillions of php code had spread over internet, without any kind of dependency control. To include libraries to your projects you have to just write include, or require. Some developers do it better than others.
So what we have ? A lots of code, no repositories, zip archives with libraries, no dependency control.
Project that uses that kind of code are still alive even today, they are solid hose of cards, and unmaintainable of course.
And main question that I'm trying to answer is Why PHP is not good ?
- First is amount of legacy code which people copy and pasted into their project, spread it even more like a virus.
- Lack of industry standards at the beginning lead to a lots of bad practices among developers. PHP code usually smells.
open source php projects in early days was developed in same conditions so even in phpbb, phpnuke, wordpress, drupal used to have a lot of bad practices in their codebase. So php developers usually not study by another library, instead they write their own frameworks/libraries.
- "It works", - there are no strong business demands, on web development, again because lack of standards, and concerns.
This three things are basically same, they linked to each other and summarize of answer of why PHP have strong smells and everybody yelling against it.
Whats is with PHP nowadays ? Of course PHP today is more influenced by good practice of webdev. Composer, Zend, Laravel, Yii, Symphony and language it self became more adult so to say, but developers...
People who never tried anything except PHP are usually weaker in programming and ecosystem knowledge than people who tried something else, python, perl, ruby, c for instance.
Summary
PHP as any other programming language is a tool. Each tool has its own task. Consider this and your task requirements and PHP can be just good enough solution.
"PHP is shit" - usually you heard that from people who never write strong applications on PHP and haven't used any good tools like Symphony or Laravel.
Cheap developers, - the bigger community, the more chance to hire cheap developers, and more chance to get bad code. That can be applied on any other language.
PHP has professionals developers, usually they have not only php on scope.
That's all folks, this is very brief, I am not covering php usage early days in details, but this is good enough to understand the point.
Enjoy.8 -
My worst dev experience in 2021 has been a PHP-based CMS developped by lobotomized, single-celled organisms incapable of coherent thoughts.
A CMS even worse than WorstPress.
200k lines of "code", no use of packages, multiple entrypoints, no namespacing, all dependencies loaded by "include" at random places and everything is dependent of every thing else... a complete mess.
One could call it the butterfly effect CMS. Adding a space could completely crash the application.
At this point I've almost developped terminal eye cancer...5 -
So I used to do some freelancing in web development last year, nothing too fancy just some simple PHP websites. Comes the worst meeting in my life. So I am from India and we have a lot of long lasting business here being passed on over generations. TL;DR the guy was the owner of a very old business which was actually very huge and the guy was educated too, so I assumed that he'll be sensible as compared to other people.
The meeting was in an expensive cafe and he paid for it, he even told me upfront that meeting is on him. Great, right? So we sit down, order some coffee and then start discussing what he needed.
The guy needed an ecommerce website built with backend and logistics system integrated. We discussed possible designs for the website and stuff too and so far the deal looked promising to both of us.
I explained him the cost estimate and told him that I would email him the final quote from myself once we discussed server cost and shit.
So now comes the bargaining part where he asked me to give him server and domain for free.
At this point, I suspected that he didn't know that servers and domains are not something that you make. You have to purchase and renew them periodically.
So I told that guy that he didn't understand the cost estimation and explained to him that X is the cost of making this fucking thing and Y is its monthly maintenance cost, if he wanted annually could be done too. And this Y did not include server and domain costing.
Now came the fucking tide, the guy straight up turned to his shit and told me I am lying and trying to con him. So I gently asked him if he had ever gotten any website made. To which, he said No, but he knows how the costing works.
I was like "Bitch?". So I calmly tried to explain that that's not how websites are done, delivered and maintained.
He didn't seemed to be understanding and kept on fucking repeating that he knows his shit and blah blah.
At this point, I was like "Okay. Fuck this dude then. I can find another project. " and then I told him that he'll need to find someone according to his needs.
Interestingly enough, the guy called someone and then walked out of the cafe while talking on phone. I waited for 5 minutes and he didn't come back so I decided I would pay for my coffee and leave. Turns out the guy had paid his bill before my arrival and ditched me with the excuse of the call.
But oh well, I think working with such an idiot would have been much worse than paying for that coffee.4 -
Story Time:
When I first started working where I currently am, the manager at the time decided to send us off to a conference about one of the products our institution was purchasing at the time. She also thought that it would be a good way for me, the new guy, to bond with the rest of the staff.
During the presentations we found out that the people surrounding us were not exactly developers because of a couple of things:
1. Some examples were done with php and javascript for adding functionality to said product. The product gave you the opportunity to script on top of it (think of some sort of CMS, but it does not use PHP as its backend language) EVERYONE from the "class" in this particular workshop said they were developers. But at the sight of php in a group of 80 people or so, only about 7 recognized it, including myself and my team.
2. When they showed an example with Javascript, in particular jquery, one of the dudes in the workshop said (with extreme senior level confidence might I add) "yeah I never liked Javascript because you really can't connect it to any database in a website" <--- my face went 0.o and one of the actual developers doing the presentation did a Jim from the Office and looked at some out of screen camera.
3. During a conf talk, one PHD dude showed an example in the template language the CMS used (an obscure Java based template language)in which he was proudly calling out a technique he used to include one snippet of code into another one.....at that time, one of my coworkers squinted his eyes in disbelief, got close to me and said "is this man telling everyone in here that he discovered how to include a file? like, as a new thing?" me: "lol yes", him: "this is a waste of time, do the docs for this thing show how to do it or is he doing some sort of strange maneuver for something the platform does not support?" me: "let me check....nope, it is included, for some reason he made a function that takes the...name of the file he wants to include and passes it over to that call inside of the body....which as per the docs it is the include function...." him: ".....fuck, what a waste of time and money, fuck it lets spend a couple of more minutes here and then go get a drink or something"
That last part was my favorite really, the man speaking was not just any phd holder, but a comp sci phd holder. To this day my dude would walk into my office and say shit like "I DISCOVERED HOW TO INCLUDE A FILE WITH PHP!"14 -
Oh man. Mine are the REASON why people dislike PHP.
Biggest Concern: Intranet application for 3 staff members that allows them to set the admin data for an application that our userbase utilizes. Everything was fucking horrible, 300+ php files of spaghetti that did not escape user input, did not handle proper redirects, bad algo big O shit and then some. My pain point? I was testing some functionality when upon clicking 3 random check boxes you would get an error message that reads something like this "hi <SENSITIVE USERNAME DATA> you are attempting to use <SERVER IP ADDRESS> using <PASSWORD> but something went wrong! Call <OLD DEVELOPER's PHONE NUMBER> to provide him this <ERROR CODE>"
I panicked, closed that shit and rewrote it in an afternoon, that fucking retard had a tendency to use over 400 files of php for the simplest of fucking things.
Another one, that still baffles me and the other dev (an employee that has been there since the dawn of time) we have this massive application that we just can't rewrite due to time constraints. there is one file with (shit you not) a php include function that when you reach the file it is including it is just......a php closing tag. Removing it breaks down the application. This one is over 6000 files (I know) and we cannot understand what in the love of Lerdorf and baby Torvalds is happening.
From a previous job we had this massive in-house Javascript "framework" for ajax shit that for whatever reason unknown to me had a bunch of function and object names prefixed with "hotDog<rest of the function name>", this was used by two applications. One still in classic ASP and the other in php version 4.something
Legacy apps written in Apache Velocity, which in itself is not that bad, but I, even as a PHP developer, do not EVER mix views with logic. I like my shit separated AF thank you very much.
A large mobile application that interfaced with fucking everything via webviews. Shit was absolutley fucking disgusting, and I felt we were cheating our users.
A rails app with 1000 controller methods.
An express app with 1000 router methods with callbacks instead of async await even though async await was already a thing.
ultraFuckingLarge Delphi project with really no consideration for best practices. I, to this day enjoy Object Pascal, but the way in which people do delphi can scare me.
ASP.NET Application in wich there seemed to be a large portion of bolted in self made ioc framework from the lead dev, absolute shitfest, homie refused to use an actual ioc framework for it, they did pay the price after I left.
My own projects when I have to maintain them.9 -
The company I interned at last summer decided to adopt a JS framework a little over a year ago. The managers went with the old Angular 1.x because they didn't want a JS build process. Each page has ~100 script tags on it, and these are manually included in various files (no automated way to include dependencies). None of the CSS/JS files are minified, either.
They really should have chose Angular 2+, or an entirely different framework (React, VueJS). They're also just now upgrading the codebase from PHP 5.6 to PHP 7.2 (5.6 support ended a long time ago, and security support ends this month).
I love the company itself but these practices are poor.
I may be working there full time eventually. I hope to eventually help with the inevitable transition to a newer framework once Angular 1.x is dead since I am an avid user of newer JS technologies. Any tips on convincing manager(s) towards newer technology? (Or at least convincing them to combine+minify these files in production to reduce # of requests and bandwidth.)
Also this company's product has millions of active users.16 -
[CMS of Doom™]
The gift that keeps on giving...
When you think you've seen it all after 7 months in legacy hell, you get another gift:
Let's say you use PHP, but your IQ is in the zero-ish range, then it is obvious to:
- use define() for constants in all your config.*.php files
- then include said config.*.php files multiple times
- and because define() doesn't overwrite the same constant, because it's - you know - a constant, you instead of including just do a file_get_contents() to read the PHP file as string and then parse the values by Regex.
The dev who wrote this was truly one of the devs ever.12 -
guys, i've got an amazing idea that will make us all rich!
now - hear me out - we start putting publicly available scooters in major cities around the world
these scooters are ingeneous and differentiate us from any competition because they are yellow instead of green or blue!!!
we're hiring now!!! who wants to join me?!?!? we're a dynamic, motivated, and hard working team. we don't have amazing benefits, a relocation bonus, an office, a tech gear stipend just yet, or a salary, but we do offer a generous 0.5% equity and our series A is just around the corner - promised - within a few weeks time! we're looking for a candidate with 10+ years experience in all of the following: PHP, MySQL, TypeScript, JavaScript, Python, C#, C++, Rust, Go, and Fortran. Additional skills, but not totally required include blockchain development, prompt engineering, and building GPT sized LLMs. DM me for details!20 -
When defining a range, let's say from 1 to 3, I expect:
[1, 2, 3]
Yet most range functions I come across, e.g. lodash, will do:
_.range(1, 3)
=> [1, 2]
And their definition will say: "Creates an array of numbers ... progressing from start up to, but not including, end."
Yet why the fuck not including end? What don't I understand about the concept of a frigging range that you won't include the end?
The only thing I can come up with that's this is related to the array's-indexes-start with-0-thing and someone did not want to substract `-1` when preparing a for loop over an 10 items array with range(0,10), even though they do not want a range of 0 to 10, they want a range from 0 to 9. (And they should not use a for loop here to begin with but a foreach construct anyway.)
So the length of your array does not match the final index of your array.
Bohhoo.
Yet now we can have ranges with very weird steps, and now you always have to consider your proper maximum, leading to code like:
var start = 10;
var max = 50;
var step = 10;
_.range(start, max + step, step)
=> [10, 20, 30, 40, 50]
and during code review this would scream "bug!" in my face.
And it's not only lodash doing that, but also python and dart.
Except php. Php's range is inclusive. Good job php.4 -
So I have seen this quite a few times now and posted the text below already, but I'd like to shed some light on this:
If you hit up your dev tools and check the network tab, you might see some repeated API calls. Those calls include a GET parameter named "token". The request looks something like this: "https://domain.tld/api/somecall/..."
You can think of this token as a temporary password, or a key that holds information about your user and other information in the backend. If one would steal a token that belongs to another user, you would have control over his account. Now many complained that this key is visible in the URL and not "encrypted". I'll try to explain why this is, well "wrong" or doesn't impose a bigger security risk than normal:
There is no such thing as an "unencrypted query", well besides really transmitting encrypted data. This fields are being protected by the transport layer (HTTPS) or not (HTTP) and while it might not be common to transmit these fields in a GET query parameter, it's standard to send those tokens as cookies, which are as exposed as query parameters. Hit up some random site. The chance that you'll see a PHP session id being transmitted as a cookie is high. Cookies are as exposed as any HTTP GET or POST Form data and can be viewed as easily. Look for a "details" or "http header" section in your dev tools.
Stolen tokens can be used to "log in" into the website, although it might be made harder by only allowing one IP per token or similar. However the use of such a that token is absolut standard and nothing special devRant does. Every site that offers you a "keep me logged in" or "remember me" option uses something like this, one way or the other. Because a token could have been stolen you sometimes need to additionally enter your current password when doings something security risky, like changing your password. In that case your password is being used as a second factor. The idea is, that an attacker could have stolen your token, but still doesn't know your password. It's not enough to grab a token, you need that second (or maybe thrid) factor. As an example - that's how githubs "sudo" mode works. You have got your token, that grants you more permissions than a non-logged in user has, but to do the critical stuff you need an additional token that's only valid for that session, because asking for your password before every action would be inconvenient when setting up a repo
I hope this helps understanding a bit more of this topic :)
Keep safe and keep asking questions if you fell that your data is in danger
Reeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee5 -
I hacked a browser game a few years ago for fun and the exploit I found and used was basically this:
<$php
$f = $_GET['f'];
$p = $_GET['p'];
$f($p);
So it was possible to pass a function and it's parameter in the URL to the server. The author used this to include() sub pages. I to highlight_file()s.2 -
So, company I work at, is on desperate need of PHP developers, who can work in WordPress and Magneto. Company announced vacancy.
Only 20 CVs were dropped 4 days before from today. So company called all of them for interview and I was one of the interviewer. Most of applicants told me that they know Laravel but not WordPress.
I was like fine. Maybe they can work on WordPress too. But I was wrong. Here are some funny interviews:
Me: how many types of inheritance does PHP support?
Applicant 1: 7. Single, multiple, etc..
Me: Do you know difference between interface and abstract class?
Applicant 2: (he just said some gibberish)
Me: why do u prefer Laravel to WordPress?
Applicant 3: because by default Laravel support payment gateway, so we can create e commerce application faster. WordPress doesn't support payment gateway.
Me: how many WordPress site you have worked on?
Applicant 4: I have 4 themes in WordPress.org
Me: Do you create all of them by yourself?
Applicant 4: Yes
Me: Do u know difference between require and include?
Applicant 4: No
Me: Do u know difference between query_posts and WP_Query?
Applicant 4: No
Me: (facepalm)6 -
So I was assigned to improve an existing internal CMS application where they wanted the ability to add extra form applications and restricting them based on people from different departments. As well as include some other improvements like speed as they mentioned that it was slow in some instances.
What I found was the original developer decided to not use any kind of framework and decided to be creative by creating his own MVC framework. With about 300 users in this system and utilising no caching of queries, views, not even using PHP OpCache, even quite a few security holes, I was damn surprised at how this thing was running. I asked the original developer why he didn't use an open source framework and he said that he thought that he'd create something and be the next Facebook.
It was a mammoth task to "improve" this system but the main thing was that I took custody of this project and that I prevented him from trying to make a bigger mess of things for this project. -
Working on a new payment gateway for one of my customers, and it turns out that instead of just specifying the parameters for what to include in the API call they want you to use their drop-in module for it...which is still written in PHP 4 and hasn't been updated since 2011. Also turns out that they only accept data formatted in XML.
Not insurmountable, but more than I feel like dealing with right this moment...7 -
Me: *holy shit there's a lot of code in this template file, I should probably break it up I to components*
*goes through the effort to break everything up into component parts*
Me: *i should quit being lazy and actually register all my templates the way magento wants me to*
*5 hrs later*
Me: fuck this! *<?php include ...?>*1 -
I started noticing something about startups here. They all think they r innovative and full of fresh ideas, but they all just copy bigger companies. My old coworker started a small web dev company and they are using php with react, the company ladder is the fucking same as anywhere else.
I noticed these as i was collecting ideas for a company (if i write that word again pls shoot me). So far we are thinking
0) no, or minimal local storage, we would have a github subscription, jira cloud, vps
1) no strict hierarchy, ultimately the ceos would make the decisions but in every meeting we would include even the interns
2) the stack would not be set in stone, java spark and vuejs are good starting points but frameworks exist to serve a purpose
3) like 2-3 days office time per week, if someone wants to work from a café, why not2 -
The client wants the booking project to be all in JS Framework (not specifying any) and NO PHP since client hates PHP (and I don't know why) from the very beginning when the only dev was my former front-end partner (lead dev).
I was wondering why the client still continued the project, YET the file extensions were still on PHP. I asked the lead dev what happened and answered he didn't know know how to start migrating to JS framework and just started NATIVE PHP.
Still, as being a good dev and a supporter to lead dev, did accept and the project as lead dev's assistant. Fixed bugs, enhancement and responsive (DEMMIT, I FREAKING HATE RESPONSIVE) and later complained why am I doing front-end tasks, when it's not my task, supposedly. I EXPECTED MORE ON BACK-END TASKS!
(HERE'S THE EPIC ADVISE GOES AND CALLED OURSELVES MASTER)
Me: Master, why did you not started the project in JS Framework instead of native php?
Lead Dev : You know what master, this project has been already done if the client allows US to use WordPress for this project will still be migrated to JS. And now, WE are trapped to make every window size be responsive since there are already a standard for each window screen.
Me: (DO NOT INCLUDE ME IN YOUR FUCKING SORCERY! I DON'T KNOW WHAT YOU DID THERE AND WHY D'YOU ACCEPT THIS PROJECT, SLAVE, WHEN YOU ALREADY KNOW YOU DO NOT KNOW HOW TO DO IT, IN THE FIRST PLACE. STOP BEING A DICKHEAD AND DO NOT WASTE CLIENT'S MONEY AND EFFORT FOR YOUR USELESS BUNCH OF SHIT!) Indeed, responsive is a such a pain in the arse.
Lead Dev: Maybe, let's just finish our tasks first and wait the project to be migrated to JS.
P.S. The project manager and client asked me if I do know how to migrate the project from native PHP to JS framework and sabotaged lead dev. OFCOURSE, YES! But, I did not respond that quickly, unless eerm, you know, I earn greater than lead dev. Truth be told and practically speaking, it's really unfair for me if I accept the back-job when the lead dev delivers inaccurate deliverables and earned greater than me. No way, Jose!
Now, I am not working with him because I'm super done with him and later did I know, lead dev is looking for Drupal dev to be working for the booking project. -
Had to create a quick server side script. Created a quick function that returns an array, and tried to access a value from the function call like this:
$val = func()[0]
Apparently php didn’t include that feature until PHP 5.4
Wtf PHP.
Log into my webhost to update the the PHP version; only to discover that the highest PHP is PHP 5.5. PHP 7 is the current revision.
Wtf a2hosting.8 -
The dangers of PHP eval()
Yup. "Scary, you better make use of include instead" — I read all the time everywhere. I want to hear good case scenarios and feel safe with it.
I use the eval() method as a good resource to build custom website modules written in PHP which are stored and retrieved back from a database. I ENSURED IS SAFE AND CAN ONLY BE ALTERED THROUGH PRIVILEGED USERS. THERE. I SAID IT. You could as well develop a malicious module and share it to be used on the same application, but this application is just for my use at the moment so I don't wanna worry more or I'll become bald.
I had to take out my fear and confront it in front of you guys. If i had to count every single time somebody mentions on Stack Overflow or the comments over PHP documentation about the dangers of using eval I'd quit already.
Tell me if I'm wrong: in a safe environment and trustworthy piece of code is it OK to execute eval('?>'.$pieceOfCode); ... Right?
The reason I store code on the database is because I create/edit modules on the web editor itself.
I use my own coded layers to authenticate a privileged user: A single way to grant access to admin functions through a unique authentication tunnel granting so privileged user to access the editor or send API requests, custom htaccess rules to protect all filesystem behind the domain root path, a custom URI controller + SSL. All this should do the trick to safely use the damn eval(), is that right?!
Unless malicious code is found on the code stored prior to its evaluation.
But FFS, in such scenario, why not better fuck up the framework filesystem instead? Is one password closer than the database.
I will need therapy after this. I swear.
If 'eval is evil' (as it appears in the suggested tags for this post) how can we ensure that third party code is ever trustworthy without even looking at it? This happens already with chrome extensions, or even phone apps a long time after reaching to millions of devices.11 -
My wife and all of our friends are Brazilian. When they are all talking in a group in Portuguese, my mind wonders off and wishing I was back doing my coding.
Like, if you want to include me, talk my language! English, PHP, JavaScript... All acceptable.2 -
I want to use Babel or Typescript for the first time. Because as I read it is the way to go, when compressing JavaScript and make it browser compatible. If that's false, please correct me.
There's a question I've got about this. Right now I am using a PHP router file dealing with requests and selecting the right .js file and compresses it. So I can write like modular JavaScript functions and include them when needed.
My question is, what do I have to change in my setup to switch to the mentioned technologies?11 -
personal projects, of course, but let's count the only one that could actually be considered finished and released.
which was a local social network site. i was making and running it for about three years as a replacement for a site that its original admin took down without warning because he got fed up with the community. i loved the community and missed it, so that was my motivation to learn web stack (html, css, php, mysql, js).
first version was done and up in a week, single flat php file, no oop, just ifs. was about 5k lines long and was missing 90% of features, but i got it out and by word of mouth/mail is started gathering the community back.
right as i put it up, i learned about include directive, so i started re-coding it from scratch, and "this time properly", separated into one file per page.
that took about a month, got to about 10k lines of code, with about 30% of planned functionality.
i put it up, and then i learned that php can do objects, so i started another rewrite from scratch. two or three months later, about 15k lines of code, and 60% of the intended functionality.
i put it up, and learned about ajax (which was a pretty new thing since this was 2006), so i started another rewrite, this time not completely from scratch i think.
three months later, final length about 30k lines of code, and 120% of originally intended functionality (since i got some new features ideas along the way).
put it up, was very happy with it, and since i gathered quite a lot of user-generated data already through all of that time, i started seeing patterns, and started to think about some crazy stuff like auto-tagging posts based on their content (tags like positive, negative, angry, sad, family issues, health issues, etc), rewarding users based on auto-detection whether their comments stirred more (and good) discussion, or stifled it, tracking user's mental health and life situation (scale of great to horrible, something like that) based on the analysis of the texts of their posts...
... never got around to that though, missed two months hosting payments and in that time the admin of the original site put it back up, so i just told people to move back there.
awesome experience, though. worth every second.
to this day probably the project i'm most proud of (which is sad, i suppose) - the final version had its own builtin forum section with proper topics, reply threads, wysiwyg post editor, personal diaries where people could set per-post visibility (everyone, only logged in users, only my friends), mental health questionnaires that tracked user's results in time and showed them in a cool flash charts, questionnaire editor where users could make their own tests/quizzes, article section, like/dislike voting on everything, page-global ajax chat of all users that would stay open in bottom right corner, hangouts-style, private messages, even a "pointer" system where sending special commands to the chat aimed at a specific user would cause page elements to highlight on their client, meaning if someone asked "how do i do this thing on the page?", i could send that command and the button to the subpage would get highlighted, after they clicked it and the subpage loaded, the next step in the process would get highlighted, with a custom explanation text, etc...
dammit, now i got seriously nostalgic. it was an awesome piece of work, if i may say so. and i wasn't the only one thinking that, since showing the page off landed me my first two or three programming jobs, right out of highschool. 10 minutes of smalltalk, then they asked about my knowledge, i whipped up that site and gave a short walkthrough talking a bit about how the most interesting pieces were implemented, done, hired XD
those were good times, when I still felt like the programmer whiz kid =D
as i said, worth every second, every drop of sweat, every torn hair, several times over, even though "actual net financial profit" was around minus two hundred euro paid for those two or three years of hosting. -
I have a small NUC-like machine in my home with an old external hdd connected to it. I use it to run my local gitlab, nextcloud and to test a few websites I build for the lolz.
If you too have a homelab, whether it's a single raspberry or an entire room full or racks, you know damn well that everything you have running locally as a web service keeps going until it doesn't, for whatever fucking reason. This time, it was the turn of my nextcloud.
The machine has arch linux running, I chose it since I already use it on my coding laptop and being a rolling release means I don't have to manually upgrade to a newer version, risking various fuck-ups and consequent screaming of profanity.
The downside is that arch is a bleeding-edge distro, so, despite being pretty good for what concerns security, as updates are pushed out some packages may still require legacy software to work as intended, since obviously not all developers for all packages can release simultaneously.
The problem was that php reached 8.2.x but nextcloud couldn't use anything beyond 8.1, so the highlighted solution was to download php-legacy, a package with a set of utilities which the cloud could use instead of mainline php.
Pretty easy, right? fuck my life, here we go.
I edited apache-httpd's configurations to link the new libraries, updated every reference in every virtual host that could possibly screw up the web server.
Done.
Then I went on and disabled the php-fpm mainline, creating a new systemd unit that would instead run the legacy executable and afterwards I edited nextcloud's additional configs so they use that instead.
Done, getting a bit dizzy, but I reboot everything and breathe.
At this point the migration should be complete, but wait, the server returns an error saying that the application is still trying to use php 8.2+...wait, what in the sysadmin Christ?
Back to nextcloud config, everything is set, everything else in every other fucking php-legacy and web server is fine, the old fpm service is disabled, I am confused, and why in the FUCKING FUCK is the new php-fpm unit failing to start at boot with "error 78/config - directory not found"? Hello? Am I being trolled by a shitty dual-core amazon fake NUC?
Maybe yes, cause it turns out that the unit was referencing a directory in the external hdd, which gets mounted at boot time after the unit itself starts, so nothing much, just a matter of tinkering with cron jobs, a reboot and at least this one is off my balls.
But why still isn't the server responding correctly? why? WHY?
After slamming my cock on the keyboard here and there scrolling back through all the config files I think to myself, hmmm, my gitlab is working flawlessly, well yeah, I didn't need to install the whole web stack, everything was nice and easy wrapped in a docker container...so why am I even here, why the fuck am I bothering with all this layered web-app bullshit, why don't I just run the up-to-date docker image that someone else has already set up for me, back up all the data and reupload them on the application?
Oh joy, you can't imagine, after 3...almost 4 hours of pure computer-touching the relief I had from seeing the blue web page with the "welcome to nextcloud" title.
Right now it's copying back all the files, and the external hdd is now linked to include the data folder.
Like really, everything was solved in two lines of bash.
I am still fuming, but at least I learned a valuable lesson, if you want a service up for yourself, implement it and deploy it as fucking easy straight-forward as you can, giving MAXIMUM priority to already fully-working options that are out there just waiting to be downloaded and used. I swing my scrotal sack on web-apps elegance as long as it's MY homelab in MY place.
Eat a fat dick php.
sudo pacman -Rns nextcloud
sudo systemctl disable --now php-fpm-legacy
sudo pacman -Rns php-legacy
sudo pacman -Rns $(sudo pacman -Qdtq)2 -
PHP features the best of the wicked minds.
In this legacy but still used project just so to save the scourge opening tcp connection (I suppose) some guy wrapped js libs like jQuery, mootools in a script tag.. In individual php files. Then from a main.php include all those libraries. This produces a 2Mb file to send to the client and it's not even compressed. This guy never had any thought about maintenance.
This is one symptom of the problem with PHP that every company developed or have in-house undocumented unmaintained frameworks made by devs without any idea about testing, security and more.
Gosh in a previous work I've seen a PHP cron that used arguments passed to a switch case of 25 cases.
It took 19 years for the language to get a standard, meanwhile leaving the web landscape as a mess of bad coding practices, bad design practices, SQL injections, outdated tutorials and more. PHP is the example that it's not because it's used on almost all the web that it's good, it only means that's it's cheap! Cheap like asking a red neck to build you a car and he tows (deploy) it to your house with his own tow truck he built.
https://blog.codinghorror.com/codin... -
In my first few months of my first dev job, I written this fragile piece of code in, trigger warning, PHP that sent out email reports to my clients. It was a two men team, and we have no clue about TDD or how to do unit testing for such code. We would just run that piece of code manually do send out dummy emails to ensure things were working.
One day the code broke. I was told by my boss to fix it. Spent the entire day trying to fix but couldn't get anything done. Finally at around 7pm my boss came by and asked why is it I couldn't get it fixed. He helped me troubleshoot and fixed it. And subsequently told me "c'mon man you're better than this."
It turns out that he changed a part of a code that was supposed return an array of strings to an array of objects, adding a second attribute that wasn't even in use.
So what that meant is that he changed a piece of working code, to include a property he didn't need, committed and push to production without even manually testing it. AND TALKED SHIT TO ME.
That was the day I learned git blame and began my journey on TDD. -
nothing new, just another rant about php...
php, PHP, Php, whatever is written, wherever is piled, I hate this thing, in every stack.
stuff that works only according how php itself is compiled, globals superglobals and turbo-globals everywhere, == is not transitive, comparisons are non-deterministic, ?: is freaking left associative, utility functions that returns sometimes -1, sometimes null, sometimes are void, each with different style of usage and naming, lowercase/under_score/camelCase/PascalCase, numbers are 32bit on 32bit cpus and 64bit on 64bit cpus, a ton of silent failing stuff that doesn't warn you, references are actually aliases, nothing has a determined type except references, abuse of mega-global static vars and funcs, you can cast to int in a language where int doesn't even exists, 25236 ways to import/require/include for every different subcase, @ operator, :: parsed to T_PAAMAYIM_NEKUDOTAYIM for no reason in stack traces, you don't know who can throw stuff, fatal errors are sometimes catchable according to nobody knows, closed-over vars are passed as functions unless you use &, functions calls that don't match args signature don't fail, classes are not object and you can refer them only by string name, builtin underlying types cannot be wrapped, subclasses can't override parents' private methods, no overload for equality or ordering, -1 is a valid index for array and doesn't fail, funcs are not data nor objects when clojures instead are objects, there's no way to distinguish between a random string and a function 'reference', php.ini, documentation with comments and flame wars on the side, becomes case sensitive/insensitive according to the filesystem when line break instead is determined according to php.ini, it's freaking sloooooow...
enough. i'm tired of this crap.
it's almost weekend! 🍻1 -
soo, i am unknowledgeable of ALL best practice.
lets say i call a php file called loader.php with a $_GET['type'] parameter, then after i check if type is actually set i switch the parameter and my logic then does stuff appropriate for $type..
do i create a lot of sub files with the program logic in it or do i just create subfunction (which i have to pass variables if necessary)?
Switch( $_GET['type'] ) { case 'foo': include "logic/foo.php"; break; default: echo "error"; break; }
or is the whole concept totally alien and stupid? i most honestly say that i dont know exactly what i could google to find an answer3 -
I'm currently writing a discord bot using the discord.py library and I cannot decide how to structure my code.
I was thinking of writing it in modules, with a core script that would load any valid module class that would include an array of all the event hooks it wanted, whether it wanted to send messages and so on.
It's a nice way to practice python after my last working bot that I wrote in (Sit down for this) PHP using an outdated and abandoned wrapper (Yeah, event-based programming in PHP, I know)
Are there any better ways to do this? I really don't want to hardcode all the functions in, only to have it fall apart later after adding another feature...1 -
Inherited a project with random include '*.php' and mysql_* functions littered everywhere, this will be fun 😀😂😐😔😞😭
-
I'm planning to make a dashboard web app with data analytics. It'll also include subscription option. So I'm trying to decide which language to use on the back end which I planing to make as RESTful api.
Current options for the backend are python, Ruby and php.
I'm not really sure about python. Ruby seems interesting, but I've read its a bit slow and some of the codes does look like magic. I'm very familiar with php, so I'm very biased toward it right now to use php with Lumen framework.
I'm also hoping to scale up the system in the future.
So, can you guys gimme a little help here in choosing a language and framework.1 -
I use /blog/ as the url for the main articles that include seo, web design, and marketing. I am looking for link ideas for articles that are more technical, articles like “How to create a php contact form”, “How to use media queries”, “How to upgrade to php 7 in cpanel” I was thinking about using /snippets/ or /tutorials/ ? Any ideas ?3
-
What the hell am I!? I wonder if you guys can help me...
I've been programming most of my life but I've never actually been a developer by title or job role. I thought maybe if I list what I do and have done someone here could help? I'm sure there are more of you in a similar boat.
- C# and VB dev for some quick DBMS projects to help me understand and mine databases and create a nice simple view for project teams to show findings from the data to help make certain decisions.
- Automating a lot of my colleagues work with Python and if very restricted then just VBA macros in Excel and MSP. This did also include creating tools to gather data during workshops and converting the data for input into other systems.
- Brought Linux to the office with most team members now moving over to Linux with the peace of mind to know that though they do need to try solve their own problems, I can help if need be.
- Had to learn AWS and then implement an autoscaling and load balanced data center installation of a few Atlassian toolsets.
- Creating the architecture diagrams documentation needed for things like the above point.
- Having said that, also have ended up setting up all the Jira/Confluence etc. servers we use and have implemented so far whether cloud (Azure/AWS) or on prem and set up scripts to automate where possible.
- Implemented an automated workflow view in SharePoint based on SP list data and though in an ASPX page, primarily built in JS.
- Building test systems in PHP/JS with Laravel and Angular to help manage integration between systems. Having quite a time right looking into how to build middleware to connect between SOAP and REST API's, the trouble caused more by the systems and their reliance on frameworks we're trying to cut out of the picture.
- Working on BI and MI and training a team to help on the report creation so that I can do the fun creative stuff and then set them to work on the detail :)
Actually it seems safe to say that it seems that though I've finally moved into a dev office (beforehand being the only developer around) I seem to be the one they go to when a strategic solution is needed ASAP and the normal processes can't be followed (fun for someone with a CompSci degree and a number of project management courses under the belt... though I honestly do enjoy the challenges)
But I always end up Jack of all but master of, well hopefully some at least. let's not even get started on the tech related hobbies from circuit design and IoT to Andoid / iOS and game dev and enjoying a bit of pen testing to make sure we're all safe at work and at home.
As much as I don't like boxes, I'm interested to know if there is in fact a box for me? By the way, the above is just a snapshot of my last two years minus the project management work...2 -
I'm gonna have an interview that will include talking about php. Problem is, I haven't touched php in 5 years. What do I need to know to sound like I know what I'm talking about? "Mmm yes I really like Laravel dependency injection, it makes managing dependencies so much easier"?5