News for hackers. Stuff that matters.

A comment on Good thing in PHP nobody talks about.

Re:Good thing in PHP nobody talks about by throwawayjava on Monday August 27, 2018 @04:17PM (#17854122)
Presumably, this guy's never seen $_SESSION hell: enormous amounts of state stashed in a single super-global associative array that persists between sessions [1].

In addition to $_SESSION hell, lots of custom PHP applications end up with extremely complex and convoluted MySQL tables dedicated to storing what would typically be global application state.

Both of these can lead to difficult-to-debug performance issues, race conditions, and especially security vulnerabilities.

Global state is going to happen, so languages/libraries should provide mechanisms that make it easy to state and enforce strict invariants on reads and writes to global state.

[1] http://php.net/manual/en/reserved.variables.session.php

[ Parent | on HN ]
Re:Good thing in PHP nobody talks about by codedokode on Monday August 27, 2018 @05:08PM (#17854566)
I don't like sessions in PHP: most times the problem can be solved without them.

But sessions are available in other languages as well:

- https://docs.djangoproject.com/en/2.1/topics/http/sessions/

- https://guides.rubyonrails.org/security.html#sessions

- https://www.npmjs.com/package/express-session

[ Parent | on HN ]
Re:Good thing in PHP nobody talks about by fgheorghe on Monday August 27, 2018 @04:31PM (#17854258)
Thats pretty much a bad practice well documented accross various php tutorials and books. But many php developers have no understanding of programming so they stash everything in that _SESSION superglobal or do other scary things.
[ Parent | on HN ]
Re:Good thing in PHP nobody talks about by throwawayjava on Monday August 27, 2018 @04:54PM (#17854449)
Global state in general is bad practice well documented across tutorials and books about programming. Article's argument is that PHP avoids global state, but _SESSION hell and "MySQL table as global state" patterns demonstrate that programmers will always find a way to shoot themselves in the foot with global state :)

Also, IME even good PHP programmers suffer from the "MySQL-table-as-global-runtime-state" syndrome. And it's at least as bug-prone as storing global state in an ADT.

[ Parent | on HN ]