...why didn't you taught him about PDO, so he can start with something more universal, not tied to one particular framework that happens to be popular nowadays?!

Then he can learn whichever OR/DM or DAL he might like need (Eloquent, Doctrine, Redbean, IdiORM/Paris etc.), and also be able to pop the hood and debug it when needed.

I never get it why so many otherwise-good PHP devs have their heads full of framework-specific knowledge and have a propensity to fall in love with heavy frameworks like Laravel, or worse, with leviathans like Symphony or Zend ...instead of playing to the language's advantages and using light-weight tools and libraries that would allow them to move faster.

It's easier point to framework that's already using PDO and and making sane defaults and solving bootstrapping problems. Once you've learned bunch of new concepts like ORM in one framework, it's easy to understand other ORs and be able to compare it to DMs.

My own experience with Laravel has been really positive. Actually I was thinking about creating something similar until I learned about Laravel, so it solved lots of existing annoyances regarding PHP coding for me.

Everybody needs to start somewhere and I believe that by nudging towards Laravel, my young friend'll learn more in the long run and in the meantime can concentrate on making services instead of writing home grown PDO helpers and custom routing libraries. They are problems that have been solved already multiple times.

Also, Symfony and Laravel communities are encouraging and teaching about the better ways of doing things so that'll help him in the long run.

In many small project it's more fun and more easier to use $favorite_framework instead of searching for reinvented wheel. There are cases when it's better to do more custom solutions but for many cases frameworks are just awesome

Yeah, that's basically why I wrote EasyDB. https://github.com/paragonie/easydb

    $rows = $db->run('SELECT * FROM comments WHERE blogpostid = ? ORDER BY created ASC', $_GET['blogpostid']);
    foreach ($rows as $row) {
        // etc
    }

In a language that already has string interpolation you're telling them to use a crappier custom version of string interpolation that's safe for databases.

Tutorials need to be more upfront about that.

I may be wrong, so please correct me if so.

Over the years, we built one in-house at http://qbix.com/platform/guide/database because we couldn't find one. It does things like sharding out of the box, because it's able to understand the query's criteria and target it to the right shards.

As an interesting side note: Laravel's AR ORM (=Eloquent) is built on top of the Query Builder so you can leverage Query Builder with AR if you know what you're doing. Can also lead to big problems if you don't realize the possibilities and the caveats.

Chicken and egg.

Education is the security strategy that pays forward the most.

There's no technical reason the language couldn't make it so that string literals can be identified at runtime.

There are several good ways to put a stop to SQL injection. Better education is one, better APIs is another. There is no reason to just give up on the idea of using SQL queries directly because of injection attacks.

...

The answer is: Data being treated as an instruction.

Solution: Separate them so that data can never be interpreted as an instruction!

In SQLi, this solution is to use parameterized queries. You send the query in one packet, then the parameters in a second one. SQLi is thus prevented.

(Not that SQLi is the only vulnerability possible.)

So, yes, total agreement there. Parameterized queries are key. I find it crazy that anything else ever existed, let alone still gets used.

Most people don't realize how much these vulnerabilities have in common, in the abstract, until you frame it like that.

Some wants to learn from bottom up(analytic approach), others want to see cool stuff then tweak, modify, replace to find the limits (holistic approach).

IIRC there is a tendency that young people prefer the holistic approach while teachers either are selected for or grow into preferring the analytical approach.

"Make them suffer like us and they will learn the holy truth" ;D

It's not like you learned to speak with your parents reading you the dictionary beginning with the letter A.

Some do, some don't.

jQuery is a common way to learn to do front end programming. It saves a lot of time when used well. But it is important to extend the knowledge to core javascript and be able to write code when jQuery is not available (like when writing scripts to embed on different sites).

Can you name a few such annoyances and how Laravel addressed them?

And do you mean to say that Laravel addresses them, while other frameworks don't?

Depending on what you mean by "move faster", I may have to disagree. Besides a one-off script, I can't envision a scenario where using "tools and libraries" would allow you to move faster than using Laravel.

Laravel comes with an unbelievable amount of stuff done for you, right out of the box. Routing, Auth, Database, Queueing, Caching, Asset Pipeline, Templating, etc, etc. If your goal is to rapidly develop an application, there really is no better framework than Laravel to get that going. There's even a vagrant box that's all tooled for Laravel.

TBF, I may have misunderstood what you meant by "move faster".

I've been a PHP dev for 15 years and the biggest issue with frameworks in PHP is PHP itself. A request comes in, the PHP process loads up everything, executes the request and tears down...on every single request.

In just about every other language, the application boots up, loads everything into RAM and each individual request doesn't have to reload things.

There are definitely trade offs here. You can have a 1 TB hard drive filled up with PHP code on a 256mb of RAM server and everything is still going to run fine. There's a lot of value in that and most people who are PHP averse seem to be turning to Lamba from AWS to fill that gap. PHP scales down better than just about anything else out there.

When the other commenter mentioned doing lightweight scripts with PDO that's essentially what he meant though. Lightweight avoids reloading libraries and PHP is lightning fast when you do that.

A lot of progress has been made over the years to help PHP handle frameworks better, but there's a big reason why PHP grinds to a halt with heavy frameworks and that's it. Check out the techempower framework benchmarks.

Using PHP like Go, however, and just pulling in what you need can be extremely powerful.

Here's an entire presentation on it that I gave to a local PHP group. http://www.slideshare.net/barrywjones3/whats-the-right-php

FWIW, I do really like Laravel and even recommend it if you HAVE to use a big framework.

Wouldn't that make debugging much much easier? Since you get a clean slate for every request, bugs can now be tracked and replicated in a saner way. I personally prefer this method for building and maintaining a huge and complex application despite knowing that it may not be an efficient one.

Without a heavy framework, you get the best of both worlds.

It's called the "shared nothing architecture", and its by design. Nothing is shared between requests, so why _not_ tear down?

That model actually has a lot of benefits for web applications (it scales very well), and I consider it one of PHP's strong points.

Is Laravel really a Rails clone? I thought that was Symfony. I honestly don't understand why the most popular PHP frameworks are all Rails clones. In my own work, I made things more in a PHP style than Ruby.

The current implementation uses shared memory.

In addition, that does not mean retaining all the variables and data, only the compiled opcodes and that's the bulk of the startup time.

This guy said it better: “Frameworks invert control. They control the lifecycle of the app, and give you entry points where your code runs. You’re still responsible for the final code, but you’re not in control.” https://aerotwist.com/blog/the-cost-of-frameworks/

Edit: Posted this before seeing the other comments suggesting it already, dope

http://www.phptherightway.com https://phpbestpractices.org

Also, I would encourage them to look at different frameworks, not just one. It'll help if they later move onto other languages, as they'll be already exposed to different ways of doing things :)

I only ask as scanning it I see that it recommends IIS7 for production PHP on windows servers. Which I believe you could only get using an unpatched windows 2008 server?

If you need to run your production system on Windows then IIS7 will give you the most stable and best performance.

So it seems to be recommending IIS7 specifically, IIS 7.5, IIS 8 and IIS 8.5 have come out since then. So it is a bit like saying you should run this software on windows vista for best performance. IIS7 is old software.

I guess I'm asking, have the IIS team given up on PHP performance or is this recommendation really out of date.

The only pain point can be when there's a new release of PHP and you have customers who want to access MS SQL databases. This is done via Microsoft's own drivers [0] (Windows only). It's not been unknown for these driver releases to lag a bit behind PHP releases, but that said I see they're on the ball now with support for 5.6.

Other than that PHP runs just as quick and as reliably on Windows as it does on our Linux shared environments (I look after both).

[0]: https://www.microsoft.com/en-us/download/details.aspx?id=200...

"LAST UPDATED: 2015-11-16 16:19:03 +0000" (right below their banner at the top)

There is some middle ground good practice which is using PDO, or even better Doctrine/DBAL . I don't think Laravel's ORM is that good, and the Active Record Pattern is somehow controversial.

AR is controversial but it is approachable.

In addition, I figure, those old PHP tutorials (code like it's the 2003!) are giving bad example and beginners can't understand the difference or realize that mysql_query + bunch of procedural code per file * 10 can be bad thing.

I should've been a bit more clearer. Laravel taught him bunch of generic best practices (like deployment procedures, GIT, OOP, MVC, etc) and using Laravel Query Builder and/or Eloquent makes the DB code more sane compared to mysql_query.

Laravel isn't the only framework which could've done this but like AR, it's quite beginner friendly :)

I am sure that it has valid use cases, but for a lot of straightforward PHP projects, it's complete overkill and adds more work than it saves (in my opinion of course).

I agree with knowing PDO though, I would say that's required knowledge for any self-respecting PHP developer.

Were you integrating Doctrine, or were you integrating Doctrine/DBAL, as the parent poster recommends?

Doctrine/DBAL is a bunch of useful helpers around PDO which take out a lot of the repetitive coding (and let me delete many home-grown methods I'd created to 'help' PDO)

Most of the time for simple crud operations it doesn't matter, as long as you handle proxy generation and caching correctly. It can add up when you try to write code working on datasets.

In those cases, I bypass doctrine and go direct to SQL.

What is controversial about AR?

How it represents rows as objects. How it makes people think about them.

How it conflates modelling the domain with database structure.

https://www.google.co.uk/search?q=activerecord+vs+datamapper

A row is the DBMS's model of an entity in the domain. An object is an object-oriented programming language's model of an entity in the domain.

Representing domain entities as objects in the PL that are backed by rows in a database relation (view or table), which is what the Active Record pattern does, is reasonable.

> How it conflates modelling the domain with database structure.

Modelling the domain should drive both application and database structure; the Active Record pattern doesn't promote anything bad I can see there.

There are particular choices in database design that are encouraged by the path of least resistance in some Active Record implementations and related tooling that are, perhaps, not so great.

There's why we disagree. I believe the DBMS's model shouldn't be conflated with the application's model. Sometimes the row is an entity in the domain; however consider a normalised data structure, where the entity as the application understands it may span a couple of tables. Or involve data from another source.

My understanding is ORMs were originally developed to handle the mapping between domains, and https://en.wikipedia.org/wiki/Object-relational_impedance_mi....

DataMappers also shine when working against a legacy database or one that cannot be changed. But ActiveRecord is a heck of a lot simpler to work with.

> Modelling the domain should drive both application and database structure

I am luke-warm on this coupling; too often it leads to the application structured around the database representation, as you point out. Sometimes this is sensible (e.g. a data-processing system), but in my experience it comes back to bite later on.

I'm interested to hear your experience - do your application models match the database structure?

If the right DB structure spans a couple of tables, then it probably shouldn't be one monolithic object in an application model (there might be a "central" object of sorts, with other related objects of which it is composed; that doesn't mean the models are identical, or even exactly 1:1, as, e.g., aggregates are sensibly single objects in an OO design, but multiple rows with some common attribute in a relational design for the same domain model, but Active Record generally accommodates that.)

> DataMappers also shine when working against a legacy database or one that cannot be changed.

I generally prefer Data Mapper as a pattern for a variety of reasons (just not the particular ones that were raised as problems with AR upthread, or, at least, for reasons that seem different to me than how those were phrased) -- even though I find that there is a usually a close correspondence between the natural relational model for a domain and the natural OO model, with divergences in models usually indicating a violation of good design principles on one side or the other (often the SRP on the OO side), I find AR itself is a violation of the SRP principle; the description of the pattern in PofEAA should raise a big red warning flag about this: "Each Active Record is responsible for saving and loading to the database and also for any domain logic that acts on the data" --"saving and loading to the database" can credibly seen as one responsibility (more succinctly, persistence) but that "and also" introduces a completely separate responsibility.

I also don't like that the simplicity of most AR implementations -- the main benefit they seem to offer for that compromise of the SRP -- tends to rest on making additional compromises, mostly in DB design and use, but sometimes on the OO side. If you avoid those compromises, you end up with something that isn't any simpler to set up and maintain than a Data Mapper, and Data Mapper gives you more freedom to evolve the persistence implementation independently (even if the model is still usually closely parallel to the application model), and even use different types of datastores.

(On a note that does approach one of the issues raised upthread, its also a fact that real world DBs and OOPLs both often require pragmatic compromises to the natural abstract relational or OO models for a domain to optimally address real problems; while it would be ideal to choose better tools -- or improve the tools -- to avoid these problems, that's often not a practical option, and tightly coupling application and relational models means that that compromise you choose on one side gets reflected on the other side, where it may not be necessary, and may be counterproductive.)

    foreach($things as $thing) {
      $thing->setValue('new value');
    } 

I think the best criticism of ActiveRecord (and ORM in general) is performance, but it's only relevant on medium-to-large websites. It is a fantastic design pattern for prototyping, and good enough for production on small-to-medium websites as long as there are caching layers above it.

Slavishly mapping a row in a database table to an application object is bad. Off the top of my head, an example could be a Product, where the tables are something like:

    product - main product details
    product_option - options (e.g. Size, Colour)
    product_option_values - values for that specific option instance

Now this is where my example breaks down as the Product needs to 'know' about what options are available (either to provide a nice API or to know what to display in the UI) and my schema doesn't allow for that (save a Product.getAllOptions() method) but I'll leave that as an exercise for my reader :)

Maybe someday we (Royal we of all software engineers who build tools other engineers use) will learn there's a limit to abstraction layers applicability and put hard breaks into the code when that happens.

I guess one shouldn't complain, the more tools allow developers to shoot themselves in the foot and not feel the pain until the leg needs to be cut off, the more variety of positions that will be open for engineers who've been there done that.

Advanced: Everything else

http://shop.oreilly.com/product/0636920033868.do

I probably won't bother with PHP, but it can't hurt to keep my idea of what it's like up to date.

It's only technology, no need to be fanatical about it.

Most people don't actually know that php powers such a large portion of the internet, because globally there's waning interest in php (http://www.tiobe.com/index.php/content/paperinfo/tpci/PHP.ht...) and it's generally dreaded by developers (http://stackoverflow.com/research/developer-survey-2015#tech...).

In all seriousness, why would you get into php at this point?

Do you want to go and work for Wordpress.com? (I mean, heck, they're building node sites now (https://developer.wordpress.com/2015/11/23/the-story-behind-...).

Are there really that many php jobs floating around?

I'm certainly not seeing it.

There are a tonne of 1-click-wordpress-for-$10 companies out there, making $10 websites using it... sure, and certainly, plenty of people use it as a blog; but is there really a professional path for a php developer?

There's no where near the interest in it that there is in engineers using say, java or C#, or heck, even javascript.

I mean, I'm totally down with looking up composer and php classes if you're curious to see what 'modern' php is like, but I certainly couldn't come up with a good reason to do it other than curiosity.

It's just like "alright that's fine". Maybe there's so many of them because my high falutin snobby peers are simply too good for dirty php. Who knows?

Curiosity is a perfectly good reason to do things, isn't it?

...but to be fair, international sites may not reflect local conditions in your particular area.

In mine, I see virtually no php related jobs.

Still, stats show it as roughly 1/5 as 'in demand' as C# or java, generally.

PHP is a poorly written language. From comparisons to namespaces to other gotchas, it's just pigs guts. From the ground up, it's a badly designed language. Look up "Fractal of bad design" for a better understanding of why.

I simply don't like to call something that millions of programmers work with "pigs guts" if I haven't actually looked at it for about a decade.

Plus, who cares if anyone learns Cobol? If they want to, there is not reason to stop them.

You can see how your opinions come off as ludicrous ?

The customers are telling you PHP is preferred to other languages and is here to stay as evidenced by 25% of the web using a single PHP application as the backend.

This is a straw man. Citing 2 popular web sites and 1 application doesn't mean PHP is a well designed language. You could just as well have picked 2 other web sites written in Java to argue that PHP is rubbish.

I wouldn't even call it influential, unless language developers have been inspired about how not to design a language. Popular, yes, but not influential. I don't see anything from it being incorporated into other languages. It generally seems to have been playing catch up in terms of features, in a similar way to javascript (where there it's less about catch-up and more about breaking out of the browser & supporting OO).

PHP has no place in modern development.

If you've truly taken the time to understand modern PHP and want to discuss its weaknesses, by all means proceed. Otherwise bashing the professional work of your peers is simply rude.

Get over your elitest attitude. PHP is a fine language and has it's warrants of use.

Speaking of, 2 days ago marked a year since I last used PHP.

http://hacklang.org/

As far as I understand, most/all new development is done in Hack.

Granted, a lot of Hack features are starting to make their way into PHP (much like how exciting new TypeScript features are making their way into ES6 and above), but focus has been shifted to Hack.

Hack is basically the TypeScript of PHP. Regular PHP works fine on Hack, but you can start incorporating Hack things into your PHP.

If you want to go that route, then my site is actually powered by Babel and not JavaScript.

The frontend is "PHP", but with a replacement engine, a replacement language, and a replacement standard library...

Having written a bunch of facebook-style Hack and wordpress-style PHP, I would personally consider them about as similar as C++ and Java.

Because some people just prefer it. They know its warts and have learned to work around it. For me it is a much easier prototyping tool. The crazy number of built in functions and libraries out there makes it so. Eg: Want to turn on and off an IoT device at sunrise and sunset? Well for other languages you have to go find some library or depend on an external service but no not for PHP. For PHP there is freaking built in date_sunrise and date_sunset functions! [1]

[1]http://php.net/manual/en/function.date-sunrise.php

If you know how to program but is bad at sysops PHP might be the choice for you since you can just install one of the many Lamp packages and used managed hosting.

But if you can set up a decent webserver on a VPS you're probably better with something else.

Thankfully I didn't get the chance to do any damage before I was exposed to modern best practices.

http://blog.a-way-out.net/blog/2015/03/27/php-framework-benc...

Did he already know javascript? if not, why didn't you point him to that instead?

He had already started building something based on old PHP tutorials, what could be more useful if he has some small site to build:

A. Tell there's a nicer and easier way to do it in PHP with well thought framework B. Tell server JS is so awesome (and all the cool kids are using:), you just need to start completely from the beginning

Introducing things gradually can help a lot and lessen the frustration. Nowadays he's really into Vue and React but still likes to handle backends with Laravel :)

Also learning is one of those things that helps if the learning stuff isn't too far away from the skills you already have. Introducing too much at the same time makes learning more frustrating - especially if you want to get something finished instead of trying to multiple ways of doing the same thing.