I am a PHP developer. Maybe even a halfway decent one. As such, I often find myself engaged in conversations on the subject of web application development in general and PHP in particular. I am continually flustered by the myths, half-truths and outright falsehoods that technical and non-technical people alike hold about this humble programming language.
I’m far from a zealot about anything software related. I think if you’re excited about software, you’re missing the point. It’s like a carpenter being really excited about hammers instead of building houses. Having said that, I feel I really need to dispel a few of these things before they fester any longer. That and I’m getting tired of being talked down to by Java developers who feel their chosen language is The One True WayTM. So here’s my list.
Myth #1: PHP is not a truly Object-Oriented Language
I hear this one a lot from Java programmers. It’s completely false. PHP has excellent OO language facilities. There’s inheritance, abstract objects, interfaces, properties and methods. Okay, there’s no method overrides, but there are ways around this. Late binding is still a bit immature. I will say that there have been vast improvements in PHP’s OO mechanics with PHP 5, but I’ve written lots of PHP 4 apps that were totally OO. The mere fact that you can write purely procedural PHP code doesn’t mean that PHP isn’t OO capable. Furthermore, the fact that PHP allows you to mix OO and procedural code makes things like bootstrap scripts really simple.
Myth #2: PHP Encourages Sloppy Code
Also false. Is there a lot of sloppy PHP code around? Absolutely. PHP’s low entry barrier means that a lot of people who aren’t formally trained developers get in over their heads. The sloppy code that results is a result of poor training and bad management, not the language itself. Saying PHP encourages sloppy code is like saying hammers encourage bloody thumbs. Sure, you can bang your thumb with hammer, but is that the hammer’s fault or yours for not knowing how to use it correctly?
Myth #3: PHP doesn’t follow MVC
I know this sounds ridiculous, but I can’t tell you how many Rail-tards I’ve had this discussion with. No, PHP does not, in and of itself, provide an MVC framework. Neither does Ruby, or any language for that matter. That’s because Ruby and PHP are languages, not a application frameworks. MVC is a design pattern, not a language facility. There are many great MVC frameworks written for PHP. I like the Zend Framework. Can you make database calls from a script that also renders HTML? Sure you can. Does that mean you should? No.
Myth #4: PHP is slow because it’s interpreted
This one is insidious because it sounds so plausible. In fact, it should be true. In practice, it’s not. The Zend Engine that powers most PHP implementations is ridiculously fast right out of the box. Combine it with an accelerator, (like the free eAccelerator) which pre-complies and caches the code (and re-complies it if it changes on the disk), and it’s one of the best performing application platforms around, even compared to things that are traditionally compiled, like Java and .NET. Short of writing your app in C or C++, compiling it native and hooking directly into the web server or something, you’re not really going to get much faster.
Myth #5: PHP doesn’t have a good IDE or Debugger
This is true. I doesn’t have one. It has several. There are at least two debuggers and many good IDEs. You can get all the goodies you’d expect, like breakpoints, variable watching, mouse-over evaluation, etc. Can you use a text editor and an FTP client? Sure you can. You certainly don’t have to, though.
Myth #6: PHP apps all look the same
I have to say, it took me a long time to figure out what people who made this assertion were getting at. At first I shrugged it off as if the person saying it was crazy. After all, PHP is just a language, you can make the output look like…whatever you want! Surprisingly, I’ve heard this a lot. Eventually I determined that the confusion stems from non-technical people confusing PHP with PHP-Nuke, which is just an application written in PHP. It’s fairly customizable, but deals in columns and boxes that all look kind of the same.
Myth #7: PHP isn’t really for “serious” developers.
This is another one I hear from Java developers (and perhaps more amusingly, .NET developers). Similar to #2, I think this stems from PHP’s low entry barrier. Pretty much anyone can learn the rudiments of hacking a PHP script together in an afternoon. Does this mean it has no place in “serious” development by “serious” developers? Well, PHP, like any development platform, is a tool. How well a tool is used varies greatly based on the skill and training of the person using it. I have written many large scale, robust, high performance applications in PHP and so have lots of other people.
Myth #8: PHP is only good for web applications
That was true once, but these days it’s pretty much general purpose. It has a command line interpreter that can be run completely independent of the web server (for scripts) but can still use your existing PHP code libraries. You can even knock together GUI applications using PHP-GTK. Admittedly, PHP’s lineage and primary purpose is web applications, but that’s far from all you can do with it.
Myth #9: PHP code is a mess of “include” and “require” statements that break easily.
Being a scripting language, PHP is interpreted at run-time. That means any code that gets executed has to get pulled off the disk and the script in question needs to know where that is. The easiest (but by far the worst) way to do this is to place an “include” or “require” statement that loads your external script. If you do this and you move or rename a file, your script breaks unless you change the offending statement. A mess of includes and requires can make your code into spaghetti.
Fortunately, by following sound OO processes, good naming conventions and using __autoload, in-line includes and requires are generally completely unnecessary. __autoload is a callback function that accepts a class name as an argument. If you instantiate a class that the engine doesn’t know about, it calls your __autoload with the name of the class as a string. Assuming you have a reasonable naming convention, (one class per file, class name and filename match) it’s pretty trivial to load the required class when you need it. This has the side benefit of only loading classes that are actually needed for a particular script, as opposed to loading all of them before your script even runs.
Myth #10: PHP Code is rife with in-line SQL statements
Take a look at a lot of PHP applications and you’ll see it. SQL being scraped together with concatenated strings and passed to database (often mysql) specific statements. This makes your code brittle, annoying to debug and maintain and subject to SQL-injection attacks. It’s also completely unnecessary and easily avoided. Simply use a database abstraction layer like Zend_DB or ADOdb instead of directly talking to the database.
So there you have it. Ten common PHP myths utterly…well…busted. This isn’t to say that PHP isn’t without its faults, but I think few other tools get the unwarranted bad rap that PHP gets. Here’s hoping I cleared things up a little!
On January 3rd, 2008 at 4:50 am Tobias Petry said:
Jaybill you said the right thing, i hate it too.
People are arguing about PHP but they have COMPLETELY NO knowledge about PHP, but somebody said it is bad so i will say the same. oO
It’s like the Myth that Java is slow only because it was slow during Java 1.4 which is 6 Years ago.
On January 3rd, 2008 at 11:33 am Stephan said:
Found a link from the Zend site and just wanted to say that these are excellent points. You can really swap “PHP” for Python, Ruby, [your fav. language] and it will still make the points valid. I agree that since PHP is so ubiquitous and easily available that it leads to a lot of amateurs dabbling in programming. But there is a lot of that in Java, Python, [again insert your favorite language] too.
Every serious developer knows that not one single language will work in every situation. It’s the beginners and amateurs that spend their time arguing over which language is better than the other instead of spending time learning proper programming skills that they can bring to any language.
On January 3rd, 2008 at 11:53 am Jeremy Kendall said:
Well said. I enjoyed the post immensely, especially the carpentry analogies.
On January 3rd, 2008 at 12:55 pm Joaquin Senosiain said:
Just like with any programming language, compiled or interpreted, you can write bad code. Java, ASP, (insert favorite language here) is not immune to this. It seems like there are a lot of programmers out there that are not doing their homework before they bash the competition. Just because it is simple, does not make it bad.
On January 3rd, 2008 at 12:57 pm rtauchnitz.de » Blog Archive » PHP-Mythen said:
[...] arbeiten kann, oder dass es nichts für richtige Programmierer sei. 10 dieser Mythen hat sich Jaybill einmal angenommen und entkräftet sie mit sehr guten [...]
On January 3rd, 2008 at 1:40 pm Daniel said:
I do not agree that there is no polymorphism in PHP 5.
What’s more, polymorphism was present in PHP 4.
All inheritance is for polymorphism. You do not have to worry about child class if you use parent API.
Think about interfaces. They are just perfect if you want to use polymorphic approach in your code.
On January 3rd, 2008 at 2:11 pm 10 falsos mitos sobre PHP » ingeniuz :: desarrollo web útil said:
[...] he encontrado este interesante artÃculo de Jaybill MacCarthy, en el que desmiente los 10 mitos más populares que suelen oÃrse sobre el [...]
On January 3rd, 2008 at 2:48 pm Jaybill McCarthy said:
@Daniel: You’re right, I worded that poorly. What I wanted to say was that there’s no method overrides. I’ll update the post.
On January 3rd, 2008 at 6:13 pm dH said:
Fortunately, you can use the PDO for DB now and you can use Enterprise Level Message Queues like SwiftMQ with StompConnect easily. PHP can be heaven or hell – it’s all up to You.
On January 4th, 2008 at 6:20 am Harold J. A. Chelala said:
Propel for ORM databases. Is great solution, mature, enterprise grade
On January 4th, 2008 at 10:09 am Mutant said:
regarding #8 don’t forget winbinder
http://winbinder.org/
I’ve created some awesome apps with this. It’s not cross platform, but it’s still really good.
On January 4th, 2008 at 3:42 pm john redden said:
Having spent 10 years as primarily a Java developer, and worked in Perl prior to PHP, and using Ruby for a while, it’s my opinion PHP5 has matured and is now the approved scripting language in our shop (over Ruby, Python and Perl, though the first two are also excellent scripting languages). So part of the question is do you want a scripted or compiled language. To you want immutable data types or “duck typing”. Also do you allow procedural code or do want “pure OO”. One solution we use which makes all the php objects and java objects available to the developer is the Quercus compiler, which compiles php5 into code that executes in the Java Virtual machine. You can then have you cake and eat it too. I’m not familiar with the php accelerator technologies, but if successful, we will see them appear in the virtual machine world of the JVM and .net common runtime.
On January 5th, 2008 at 7:32 am Daniel said:
There is no method overloading, but method overriding exists in PHP (4 and 5).
You can override parent class method in child class, but what you cannot do (and that is one of the differences between PHP and languages like Java, C# or C++) is to overload a method, which is having 2 and more methods with the same name but different list of arguments.
TBH even overriding in PHP is different than in Java (for example), because in Java you cannot change list of arguments (if you do it means you overload method). In PHP you can change list of arguments in method that you override and it is completely legal.
On January 5th, 2008 at 10:14 am Cory Duncan said:
@Daniel http://tinyurl.com/2hlo3j
On January 5th, 2008 at 3:35 pm Jaybill McCarthy said:
@Daniel: Once again, you’re right. I said override when I meant overload. Your explanation is great, thanks for posting that.
On January 5th, 2008 at 3:37 pm Jaybill McCarthy said:
@Mutant: Man, I’d never heard of that! That’s cool! I love that it talks directly to the Win32 API, I bet that’s crazy fast.
On January 5th, 2008 at 9:54 pm Finn Higgins said:
You’re right as a whole about many of the criticisms of PHP not being inherent in the language – lack of MVC, inline SQL, sloppy spaghetti code… none of that *has* to happen in PHP.
On the other hand, it *does*, more often than it doesn’t. PHP has a low barrier for entry, but it also has a community very well-versed in producing and communicating bad coding practices to each other. If you ask me that’s largely because PHP has little to offer a programmer looking for a 3rd or 4th language, it’s only really relatively new programmers who’ll settle into its structures without missing something substantial or being annoyed by something. Most PHP programmers who go on to learn Ruby or Python leave, and don’t come back unless there’s money in it.
PHP is interesting in that it has a very good implementation – very stable, really quite fast, plays well with Apache. But on the other hand, the language itself is one ugly bastard: No standard unit testing framework in the core, no namespaced/OO core API… then there’s the carpal tunnel syndome factor:
$instance->call();
vs
instance.call
That’s a lot of unnecessary shift key, kids…
If you were to ask me which I’d rather deploy/host for clients out of PHP, Python or Ruby I’ll take PHP in a heartbeat. But program in? Last place, by a country mile. Both Ruby and Python are worth learning a bit more about deployment for, thanks very much!
I think the big thing is that PHP has, as a language, few advantages over anything whatsoever. It’s just got a great implementation.
On January 6th, 2008 at 1:06 am Jaybill McCarthy said:
@Finn Higgins: Thanks for reading and commenting. You make some valid arguments. A few things I’d like to point out or add:
1. I’d like to know what you’re basing your “most programmers never go back” statement on. With RoR in particular, I know *lots* of people who have “gone back”. I’m hardly unique.
2. As for the testing framework a) that’s really not the responsibility of the language itself. b) there are several good testing frameworks, including PHPUnit (http://www.phpunit.de) and SimpleTest (http://simpletest.org)
3. Your point about terse code is well taken. $foo->bar() is kind of excessive. In general, though, I don’t really think it’s all that bad. Java and .NET are almost unusable without an IDE that can auto-complete method names. (I’m looking right at you, DefaultMutableTreeNode!)
4. I think your argument about taking extra time to learn deployment because the language is better is problematic for two reasons: 1) in the case of Rails, no amount of additional learning is going to make that thing any less of a pig in a production environment. (Can’t speak to Python frameworks, don’t know them.) 2) If the framework is unstable (like RoR) what difference does it make how beautiful my application code is?
On January 6th, 2008 at 4:35 am anonymous said:
what about:
- security? (PHP is very insecure by default)
- naming conventions? (see http://tnx.nl/php)
- namespaces? (will be added soon but too late imho)
On January 6th, 2008 at 6:35 am Victor said:
Why you avoiding the main demerit of the PHP: low entry level? Do you understand that it is critical?
In your several points you have described consequences of this sadly fact but why you don’t want to see real reason of these problems?
On January 6th, 2008 at 8:40 am AkitaOnRails said:
Good article. I was a Php developer in the 4.0 era, so I am not on par with 5.0. But one thing that always annoyed me was the lack of namespacing. Did this improve nowadays?
And you’re right that people shouldn’t simply dismiss it. Facebook certainly didn’t and it is doing better than most of us.
On January 6th, 2008 at 1:05 pm Jaybill McCarthy said:
@19 (anon):
1 – PHP isn’t inherently any more or less secure than any other language. You can write insecure applications in any language.
2 – Guilty as charged. This has a lot to do with the fact that at least in the beginning, PHP more “happened” than it was actually planned, meaning a lack of naming conventions for core functions.
3 – Too late for what? Are you implying that anything that isn’t perfect on the first try should never be improved? That’s a little silly.
On January 6th, 2008 at 1:13 pm Jaybill McCarthy said:
@Victor: I really don’t see anything that allows people to easily accomplish things as a “demerit”.
Are you saying that the only worthwhile development tools are those that are hard to use?
Honestly, I think this idea comes off kind of elitist. The fewer barriers there are between an idea and a working website, the better. Tools should not have a high entry barrier simply for the sake of making users of those tools feel superior.
On January 6th, 2008 at 2:19 pm Victor said:
@Jaybill McCarthy:
>The fewer barriers there are between an idea and a working website, the better
I can’t agree with this, because it is not just about working website. The quality of this website is also important. It is important for all people who will support this website later. It is important for hosting provider that wlll want to upgrade his software version someday and don’t like to hear ‘Please return my favourite deprecated function because everything is unworkable now!’ It is important for XHTML coder that will want to change only one layout instead of 30 various pages on the website made by someone who have not heared about layouts and partials. It is important for SEO who will want to change titles and h[1-6] of different pages in one place of code.
If someone wants to drive car then he need to pass exams for drive license. Otherwise he will just kill someone on the nearest road. We can’t control programmers by events like certification, exams and so on. This is why the only possible way is internal limitations of language, its ‘culture’ or at least medium entry level.
This is why NOT all people should create programs and this is why low level of entry to the php-world is demerit.
On January 6th, 2008 at 2:41 pm Adam said:
I also admit that PHP has its problems. Its naming conventions for functions to name one issue. But that’s not to say it’s not a decent language, after all, I wouldn’t be running the TalkPHP community if I thought it was a bad language. It’s just I like to keep at least a little distance from everything until I can honestly say it deserves to be backed by utter certainty in my convictions. At the moment, PHP merely deserves a chance to prove itself, and that’s what it’s going to get from me.
Evidently, PHP has a way to come yet on the OOP side of things, but just like Maxon Cinema 4D in the 3D world, it’s slowly creeping up the ladder and will be ahead before you know it. Perhaps overtaking Java is an improbable, if not impossible task, I admit. But that doesn’t mean it cannot be equal.
I feel PHP 5.3 will bring us a lot more in terms of the namespaces and the alternate ternary operator, as well as all the abundance of features, both big and small, that it’s going to bring to the table.
All I have to say now is thanks for a good read! A truly informative article from yourself.
On January 6th, 2008 at 2:48 pm 10 PHP Myths Dispelled - TalkPHP said:
[...] PHP Myths Dispelled I found this on Alan’s blog, to which he then linked through to the original post. So I thought I would bring it over here for anybody who wants to contribute their thoughts. I [...]
On January 6th, 2008 at 4:46 pm anonymous said:
@Jaybill McCarthy
1. get a random PHP’s ChangeLog: there are several items for insecure *core* functions (check stephan esser blog’s please)
3 – introducing a namespace is a NOT a trivial thing
On January 6th, 2008 at 5:51 pm Sudhanshu said:
#3 is funny. You shouldn’t be talking to people like that about programming. Your fault. heh..
About #5, I think PHP is the best because you don’t really need IDEs as much as you require them in Java. Vi is perfect in most of the cases that I’ve seen. Ofcourse, most of the java people don’t understand that you can code well without an IDE.
On January 6th, 2008 at 10:18 pm Finn Higgins said:
Jaybill – thanks for the response! I’m writing this from the perspective of somebody with a few years of PHP experience and including a few projects into tens of thousands of lines of code in active deployment, so I obviously don’t completely hate the language. It’s certainly a more enjoyable experience than Java or .NET, but I have to admit that since learning Python and Ruby I’ve got a much lower tolerance for working in PHP.
My impression of people leaving PHP for Python or Ruby (which was what I said, rather than Rails specifically) is really only based on first-hand knowledge of friends and colleagues. Both Python and Ruby have a lot more to love about them as languages. PHP does have merits, but the language syntax and core libraries aren’t included in those.
Unit testing – you’re right, it’s not the responsibility of the language. If we were talking about C or another general-purpose language I’d be agreeing with you in a heartbeat. But on the other hand, MySQL support, integration with GD, encryption, output buffering or any of the other myriad specialised functions in the PHP core API aren’t the responsibility of the language either, but PHP gives you them. PHP is a language that has built its userbase on providing a suite of commonly used tools for web development – a “batteries included” approach, if you will. But for some reason, PHP seems to feel that automated testing is less of a core language feature than, say, spell-checking support, PostScript or SWF library support. As such few beginning PHP developers even know what unit testing is, let alone that they actually *need to be doing it* if they’re writing production code in a dynamically-typed interpreted language. That’s what I mean about PHP and its encouragement of poor code – it provides lots of powerful tools for implementing *features* in web applications, but very limited support for the development of robust, stable, well-engineered software. That’s not to say that the tools to do this aren’t out there. But honestly, if you had to pick one of these statements then which would ring more true:
“PHP’s core API is dedicated to making it easy for inexperienced developers to build feature-rich web applications”
vs
“PHP’s core API is dedicated to providing the tools developers need to produce robust, high-quality web applications”
…?
To me the answer to that is pretty obvious. A low barrier for entry on a language can be an advantage; but doing that at the expense of much-needed features to support actually developing stable software is not, because it results in a wealth of developers who’ve never tested a line of code in their lives.
I’m glad we’re on the same page on the terse thing, and I agree with you on the Java/.NET ExtremelyExcessivelyLongNamesThing. But the ugliness in PHP comes from the heavy use of totally worthless non-semantic characters like $ and -> where they’re actually totally unnecessary. Having to prefix completely vanilla variables (!!!) with a shift-key-requiring modifier is just crazy. I mean damn… does anybody do much programming without variables?
Getting onto deployment.. I wasn’t actually entirely thinking of Rails here. PHP has it the easiest because mod_php is a thing of beauty and just works. mod_python is OK, but I’ve had issues and had to resort to FastCGI at times – something I’ve never had to even be aware of in PHP. mod_ruby is a turd and nobody uses it, with most deployment happening behind Ruby web server clusters and proxy balancers.
I haven’t experienced any of your problems with Rails though. It’s certainly resource-hungry, but given reasonable resources I’ve had no issues with it in production apart from ActiveRecord hitting the database too hard if you fail to pay attention and scope your queries properly. And hey, if you want to do Ruby development with most of the advantages of Rails but with better performance metrics then there’s always Merb.
On January 7th, 2008 at 3:27 pm Michael Erhard said:
PHP as a language clearly has its weaknesses, and most of them are named here.
For me the bigest issue is the codbase you find in the net, and the bad code level many developers deliver usually.
Don’t interpret me wrong, I practicly develop PHP applications on a daily basis since 10 Years. And after a short training every serious PHP developer can produce quality code. And it is much more easy to find “cheap” PHP developers than Java or C/C++ developer
On January 7th, 2008 at 4:38 pm Joscha Feth said:
You forgot the classic:
Someone: “PHP does not even have types! How can you program seriously with that?”
Me: “PHP does have types, what you mean is type-safety!”
Someone: “Whatever – besides, what’s the difference?”
:-S
On January 7th, 2008 at 10:32 pm Jaybill McCarthy said:
@31 Joscha Feth: You’re right! That’s a big one. The same could be said of any dynamically typed language, but PHP seems to bear the brunt of this somewhat dubious criticism. If you ever want to send those same people running away screaming, here’s something else you can share with them. Marcus Boerger (of PDO fame – http://www.php.net/credits.php) told me over a beer at ZendCon that declaring types (as opposed to just letting the interpreter figure out what you’re trying to do) negatively impacts performance because of the additional overhead! Crazy!
On January 8th, 2008 at 1:54 am Thomas Fritz said:
I think most people who are speaking about PHP in negative way, think PHP is at the same profession as PHP/FI. And yes, unfortunately, PHPs reputation is (mostly) negative because of many PHP-”Developers”.
On January 8th, 2008 at 11:31 am Lucas Carlson said:
Just because a language contains a feature, like the ability to write object oriented code, absolutely does not make it an object oriented language. You can and always do write functional code in Ruby with blocks, yet Ruby is not a functional language. PHP lets you write object oriented code, but it is not a truly object oriented language. To classify a language, you can’t just ignore its core and standard libraries.
“The mere fact that you can write purely procedural PHP code doesn’t mean that PHP isn’t OO capable”
And the mere fact that you can write purely OO PHP code doesn’t mean that the language is OO.
On January 9th, 2008 at 12:04 am Manuel’s Blog » Blog Archiv » 10 Mythen über PHP said:
[...] seinem Beitrag geht er auf 10 Mythen zu PHP [...]
On January 10th, 2008 at 9:39 pm Fender Borton said:
PHP-bashing is a bunch of hype and BS from Java fanboys. Java has a huge learning curve because of its bloated verbose libraries, and Java fans want to justify all that time they wasted. Ignore them.
On January 11th, 2008 at 2:36 am cooom said:
From my perspective the endless discussion about which language is better or worse is a cultural thing.
Many people without formal training use PHP because the ease of getting things running – no matter how ugly the implemntation is.
Java on the other hand is so daunting at first encounter that the developers unsing it tend to be quite experienced. Once they cut their path trough, they tend to overuse the features and frameworks provided and overcomplicate things.
The path to enlightment the combination of both ways. The pragmatic approach of the prototypic PHP coder applied with the knowlege how to write proper code of the prototypic Java programmer, realized with the language which suits the task at hand best.
On January 12th, 2008 at 7:17 am High Quality PHP Code? Really?! — www.topicobserver.com said:
[...] I don’t take it personally enough to go on a rant about it, I want to point to this article: 10 PHP Myths Dispelled. Simply because I hear this kind of joke way too often. And way too often, people seem to think [...]
On January 12th, 2008 at 7:32 am peterpan said:
“abstract objects”?
Sure it’s not supposed to be abstract *classes*?
On January 13th, 2008 at 5:31 pm anonymous said:
> PHP-bashing is a bunch of hype > and BS from Java fanboys. Java > has a huge learning curve
> because of its bloated verbose > libraries, and Java fans want > to justify all that time they > wasted. Ignore them.
huge learning curve for you. Please learn to write true object oriented code and stop kidding.
On January 16th, 2008 at 4:32 am CiT said:
Nice post, i think the same way …
On January 16th, 2008 at 11:20 pm Suburban Chicago PHP » Blog Archive » 10 PHP Myths Dispelled said:
[...] 10 PHP Myths Dispelled [...]
On May 29th, 2008 at 12:35 pm CRR said:
Great points, all. The only valid issue I’ve seen is that PHP completely lacks a threading model. There are hacks available, but they’re just hacks. I’ve been able to accomplish some amazing non-Web things with it, but without threads, I always hit a wall.
It’s still my favorite language, but if I was really going to write a stand-alone app this one is a show-stopper for me. I think this factor is an important reason why Ruby and Python are so popular.
On November 26th, 2008 at 12:03 am PHP Myths « Nurul Islam said:
[...] So here’s Jaybill McCarthy’s Blog: 10 PHP Myth [...]
On February 4th, 2009 at 3:17 am aristarkhos said:
i wish someone would throw some more light on the security aspect. the only reason our IT guys refuse to move from JSP is because they think PHP is insecure. which i refuse to believe.
from what i have read…it probably takes more time to get work done with jsp. though that is also dependent on proficiency.
On February 4th, 2009 at 7:54 am Jaybill McCarthy said:
@aristarkhos Thanks for writing! PHP security expert Chris Shiflett has actually written a great book on the subject. It’s called Essential PHP Security and it’s published by O’Reilly. It’s a very quick read, if that’s any indication. :) I also find it amusing that there are people touting how secure JSP is. A poorly written JSP application is just as insecure as a poorly written application in anything else.
As for the productivity part, I think for the most part you hit it right on the head. PHP to JSP isn’t really an apples to apples comparison, but depending on what you want to do, PHP could greatly reduce the amount of code you have to write to accomplish the same task.