News for hackers. Stuff that matters.
Re:Why must you laugh at my back end? by jerf on Tuesday August 30, 2011 @02:47PM (#2942699)
"I'm working on such an app now, and right now the fastest way I can get anything done is writing similar code to what I wrote in 2003. It's not quite as bad, but I continually succumb to doubt."

The biggest objective problem this style has is that it affords everything-injection; cross-site scripting attacks, SQL injection, command injection if you're using shell commands, etc. Every time you bash one string together with another one, you run the serious risk of introducing a security attack, and with this style of programming, you basically have to be thinking about every single string concatenation.

Using a framework that will take some of the cognitive load off can be a net gain. It need not be a Glorious Framework, it just needs to be something that makes doing the right thing easier than doing the wrong thing.

Otherwise, most of the rest of the pain will be felt by you, not your customers, so hey, whatever, go nuts. But this is a legitimate objection to this approach. (And a legitimate objection to every framework that fails to make the right thing easier than the wrong thing, which is still a great deal of them.)

Re:Why must you laugh at my back end? by steve-howard on Tuesday August 30, 2011 @04:51PM (#2943198)
What I find interesting about PHP (among many laughably bad things about it) is that one of its key strengths for beginners is the easy mode-switch between scripted and verbatim mode (i.e. <?php and ?>), but all the large software projects whose code I've read used some kind of templating.

I agree with the sentiments around here, though. If the goal is to write software that works and hopefully makes money, do what you know and ignore this year's hot new framework/language. Write readable code in case you need to refactor it later.

Re:Why must you laugh at my back end? by dangrossman on Tuesday August 30, 2011 @10:47PM (#2944029)
What do these things have to do with a framework? PHP's built-in MySQL drivers (MySQLi, PDO, etc) support and encourage prepared statements and parameter binding. PHP's built-in string library supports HTML-encoding output. PHP's built-in filter library supports validating and sanitizing input. Writing apps without some kind of framework might lead to less organized, tighter coupled code, but it doesn't mean you're mashing together strings and ignoring security.
Re:Why must you laugh at my back end? by mhansen on Wednesday August 31, 2011 @02:07AM (#2944515)
Small nitpick: the customers will feel the pain if their username/password is leaked through SQL injection.