Suddenly 5.1 Isn't So Exciting

PeeaycHPee

Friday, August 12. 2005

Suddenly 5.1 Isn't So Exciting

Up until today, I was really pumped up about the imminent release of PHP 5.1. Then I read this.

I'm still excited about 5.1, but it now pales in comparison to the potential that exists in 6.0.

The best part, though, is the general concensus of change that's attached to the thread.

Read on for my opinion on the points that have been brought up.
Let's take a look at Rasmus' original ideas:

QUOTE:
1. Remove register_globals completely

Yes! Anyone with half a clue agrees that register_globals shouldn't be used. Let's help those with a lower clue-ration.

QUOTE:
2. Remove magic_quotes_*

Yes! Same rule as #1. I really hate cluttering up my (must-be-portable) code with stuff like "$var = get_magic_quotes_gpc() ? stripslashes($_GET['var']) : $_GET['var'];"

QUOTE:
3. Add input filter extension which will include a mechanism for application developers to very easily turn it off which would swap the raw GPC arrays back in case the site had it turned on by default.

I was originally against this idea. Well, more like against automatic filtering. I've since changed mind.

One of the things that I had the opportunity to chat with Rasmus about at Conf. PHP Quebec 2005 was admin-implied input filtering. He told me that input filtering should be an option of the system administrator, and shouldn't always be left in the developer's hands. This makes sense. It's primarily the developer's burden to write good code, but most of us run apps that weren't written by us. There should be some way to apply blanket filtering.

Obviously, to make this system work, there needs to be some way for the developer to access the raw, unfiltered content (yes, there ARE occasions where it's necessary to grab '<', '>', and '"' from the request. My retort to Rasmus' theory of admin power was "If the developer can get to the raw data (and he has to be able to do this), how are we any better off? Yes, a good developer will use this mechanism ONLY when necessary, but what about a Jr. developer who 'learns' from the wrong piece of code?" His answer: it'll be simple to grep for this mechanism. So, I conceded. I'm now all-for an automatic input filter.

QUOTE:
4. Include an opcode cache by default. A lot of work has gone into pecl/apc recently, but I am not hung up on which one goes in.


Zend politics aside, I don't know why this hasn't been pushed harder before. +1

QUOTE:
5. Remove safe_mode and focus on open_basedir

I've never had the.. uh.. "pleasure" of working with safe_mode, professionally, but this SEEMS like the best option. Yes, it will upset a LOT of web hosts. Hopefully they'll see the light. I'm not holding my breath, though.

QUOTE:
6. Remove some stuff that has been marked deprecated since PHP 3/4

Please, yes. With the exception of dl() (-:

QUOTE:
7. Make identifiers case-sensitive
8. Remove various function aliases


These, I don't really care about. Either way is fine by me.

So there's my 2c (Canadian).

What do you think?

S
Posted by Sean Coates in Community at 23:00 | Comments (9) | Trackback (1)

Trackbacks
Trackback specific URI for this entry

The state of PHP
PHP is moving on towards gearing itself for PHP 6.0. Andrei started warning people to not commit to HEAD as he was about to start committing his Unicode support for PHP. He mentions in his blog post: The project that...
Weblog: Jacques Marneweck's Blog
Tracked: Aug 15, 13:08

Comments
Display comments as (Linear | Threaded)

These are defintely some excellent suggestions and will be a great improvement for PHP. My question is though, is this it? Surely PHP 6 is not just going to be about Unicode support and tidying up some of PHP uglier parts. If you look at all the cool stuff added to PHP in version 5 isn't PHP 6 going to have more of the same scale improvements. I know its still early days for PHP 6 development so I'm just curious what else might be on the cards.
#1 Luke van Blerk on 2005-08-13 18:14 (Reply)
Just Unicode? There is nothing "Just" about Unicode.
#1.1 Anonymous on 2005-08-14 04:33 (Reply)
Ok, why is Unicode a big deal then? I'm not too familiar with it.
#1.1.1 Luke van Blerk on 2005-08-14 07:31 (Reply)
Unicode is what php lacked for ages. Its a great improvement but i would also like to see some more improvements to the OO part, to make it even more like other OO languages.
Some more things might be improvements to PDO
#1.1.1.1 Akexej (Homepage) on 2005-08-15 15:27 (Reply)
like to see a more enterprise bent - namespaces, templating, threads, messaging, more towards porting php to .net and java for seems interoperability between the two - gluecode for the web ( i know Perl ). Ruby on Rails model for quick MVC creation
#2 vinny on 2005-08-16 00:26 (Reply)
QUOTE:
I really hate cluttering up my (must-be-portable) code with stuff like "$var = get_magic_quotes_gpc() ? stripslashes($_GET['var']) : $_GET['var'];"


So why not just use ini_set('magic_quotes_gpc',false);? Don't test for it every time you need a request parameter, just switch the damn thing off before you start coding!
#3 Dysfunksional.Monkey (Homepage) on 2005-08-17 13:12 (Reply)
you've obviously never actually DONE this.

by the time your code (the ini_set line) executes, PHP has already run the mechanism that takes requests and puts them in the variables.. so, your little trick has no effect.

S
#3.1 S (Homepage) on 2005-08-17 13:20 (Reply)
Sorry, my fault. I meant php_value in the .htaccess file (on apache). I use lighttpd and build php manually, so always switch it off in the ini.
#3.1.1 Dysfunksional.Monkey on 2005-08-17 16:04 (Reply)
Yes. I do this as well in environments I control..
however, to write portable code, or code that works in a "dirty" environment, you need to check magic_quotes_gpc.

S
#3.1.1.1 S (Homepage) on 2005-08-17 16:10 (Reply)

Add Comment

BBCode format allowed

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

You can use [geshi lang=lang_name [,ln={y|n}]][/lang] tags to embed source code snippets
 
 

Pay the bills...

Calendar

Back August '08
Mon Tue Wed Thu Fri Sat Sun
        1 2 3
4 5 6 7 8 9 10
11 12 13 14 15 16 17
18 19 20 21 22 23 24
25 26 27 28 29 30 31

Quicksearch

Archives

August 2008
July 2008
June 2008
Recent...
Older...

Syndicate This Blog

My PERSONAL Blog

Note:
The contents of this blog are my own, PERSONAL opinion and do not represent the thoughts or opinions of the people I work with or for. If you have a beef with something I said, take it up with ME. Thanks (-:
Geo Visitors Map