Why PHP programmers aren't considered real programmers

[Ariphaos]

Code: Select all

<?php

  $arr = array ();

  for ($i = 0; $i < 100000; $i++)
    {
      $c = mt_rand (0,1);
      if (!isset ($arr[$c])) $arr[$c] = 1;
      else $arr[$c]++;
    }

  ksort ($arr);

  foreach ($arr as $key => $value)
    {
      echo '<b>'.$key.':</b> '.$value.'<br />';
    }

0: 24969
1: 75031

Half of my development time with PHP is basically rewriting things I can't trust the php team to have done properly. I think this epitomizes it.

[General Zod]

Can someone translate this into English?

[Ariphaos]

It's a php (the same programming language this forum software was written in) script that attempts to generate 100,000 numbers, chosen between zero and one. Or heads and tails.

It's supposed to be rather evenly distributed between them, so 0 should come up half the time, and 1 the other half. Instead, 1 is showing up three quarters of the time.

Ie, you flip a coin 100,000 times, you expect heads about half the time. Instead, php's rand() and mt_rand() functions are returning heads 75% of the time.

[Ryan Thunder]

What exactly did they do wrong? It looks like they're using a standard method to generate the random numbers, if I've read it correctly. Then again, I'm not familiar with php, just curious.

[Ace Pace]

Or it could be the total lack of proper coding among large PHP code bases. Globals, lack of documentation, ugly ways of writing extensions to their programs. I hate the major PHP code bases like MediaWiki and PHPbb.

[Ariphaos]

What exactly did they do wrong? It looks like they're using a standard method to generate the random numbers, if I've read it correctly. Then again, I'm not familiar with php, just curious.

There should be nothing wrong with my script above, and in most languages, there wouldn't be. PHP implements rand () and mt_rand () incorrectly, however.

PHP is littered with all sorts of these bugs, and it's quite a problem. Worse, they actively refuse to fix it. I'm sorely tempted to switch to Python, but that would mean rewriting flup. C is an option but I'd have to write my own fastcgi handler. Rather frustrating.

[Ace Pace]

I think Destructionator here wrote a library to deal with C/CGI issues, check it out with him.

[Drooling Iguana]

Which version of PHP are you using? I ran that code on my system and the results are coming out fairly even. I'm running PHP version 5.2.10.

[Ariphaos]

Which version of PHP are you using? I ran that code on my system and the results are coming out fairly even. I'm running PHP version 5.2.10.

5.2.11 (CentOS 5.3 32 bit) and 5.2.12 (Debian Squeeze 64 bit).

I would have to imagine that this isn't occurring on all platforms/configurations else it would have been caught.

I created my own RNG suite anyway that pipes from /dev/(u|f|e)random.

[Bedlam]

Now I'm not a programer and I assume from the previous posts that there is something wrong with the underlying code, however, if this is just a single run of the 100,000 repeats there the chance of 1 and 0 could still be the same and still give a 25/75 split, its just unlikely (someone might be able to do the calculations). You would expect it to tend towards 50/50 but it could be 100/0 and still be random its just very very unlikely. I assume that multiple runs all end up with the approximatly the sam split?

[fuzzymillipede]

if this is just a single run of the 100,000 repeats there the chance of 1 and 0 could still be the same and still give a 25/75 split, its just unlikely (someone might be able to do the calculations). You would expect it to tend towards 50/50 but it could be 100/0 and still be random its just very very unlikely.

Maybe if the sample size was 10, something like that could happen. But with a sample size of 100,000, the chance of any significant deviation from a 50/50 split is practically zero. At that sample size even a 60/40 split would mean there was a problem with the RNG.

[Ariphaos]

Eh, not really. When I do cgi in C, I just recreate the little pieces I need as I need them. I do have some CGI stuff in the D language, but I keep hacking it up and breaking it, so that's not redistributable either. Though, FastCGI and CGI aren't the same thing anyway...

The issue is I would actually need to write it and be competitive with -and more stable than- php+APC-stat. Flup is neither stable enough nor fast enough to handle thousands of connections per second on my server.

PHP, actually, is.

There's fastcgipp, but that was designed for integration with mod_fcgid. PHP's raw fastcgi overhead is actually significantly less than the difference between Apache and nginx.

For PHP, what I find most hilarious are the people who layer shit on top of it. Ever used the Smarty template system? why God?! WHY?!

I tried to. It's ostensibly to allow end users to do semi-code level things with some level of security.

I think I'll just whitelist allowable css elements and unicode points, myself.

I've been dealing with this php shit for a client for months now. The client paid like $2000 for a license to this fucking thing - for that kind of money, you'd expect it to be decent, right? Wrong, it's PHP!

There is a vBulletin plugin to Sphinx search that costs $2k. It is only marginally more impressive than the one built for SMF. The one the phpBB team built is a joke, and who does the phpBB dev blame?

Sphinx's author.

Insane.

On the top level, the code is spaghetti, of course. Things are repeated all over the place - every single file in it has about 80 lines of the same boilerplate, only slightly different each time. (Functions? What are they for?) Every function it does have starts with a long list of globals - about 15 of them. Among them is a database class... that just wraps the built in mysql library, obfuscating the myriad sql injection holes.

What's really annoying is that mysql(i)_real_escape_string still has a major security hole, as no widely used cms's database wrapper uses prepared statements and all of the major forum softwares encourage utf8 conversion.

Which means the database's default character set may be latin1, but if the forum/cms owner got convinced to use utf8 tables, every single one of those forums is vulnerable to SQL injection via unicode code points. Because none of them know about prepared statements.

The Internet functions because smart people are not in general evil.

Seriously.

Then, there is this retarted, utterly worthless Smarty thing. All it does is duplicate the one thing PHP itself does reasonably well, but with more slowness. You add a pile of boilerplate to the PHP to use it... then the template just has more embedded PHP! And of course, repeated instances of nested tables all over.

How the fuck did something this messed up pass review? Easy - it didn't have review!

In the time I've wasted trying to work around the shit and deal with the repeated bloat, I could have just rewritten the thing from scratch myself. But noooo, we must reuse existing code!

It's faster to write code than to read it. A very important distinction that I like to remind clients of.

Fortunately, for my current major project, the only person I answer to is me.

[Zixinus]

If I get the posts correctly, is PHP fundamentally flawed? Because that is the point that I feel gets across. How did that happen?

[Chris OFarrell]

Its free, and it has been the mantra of a lot of geeks that Apache + PHP = Liberation...or something.

[Xon]

Mysql and secure? Don't make me laugh.

mysql_real_escape_string doesn't protect against against SQL injection properly with dynamic sql even ignoring unicode! Linky.

I'm not sure if I trust php & mysql todo prepared statements properly, but it is much safer than relying on known buggy sql escaping encoding in php (which they still haven't gotten right).

[Starglider]

If I get the posts correctly, is PHP fundamentally flawed? Because that is the point that I feel gets across. How did that happen?

Quite a lot of programming languages are someone's personal crappy scripting language that somehow escaped and gained popularity. These are kludged together with no real understanding of language, compiler or library design, and they universally suck. Perl is in this category despite massive efforts put in for over a decade to try and make it into a real language (why anyone would want to, I don't know).

These languages are attractive only because they seem simple and easy to pick up. In actual fact, all the 'counterintuitive' and complex features in other languages are generally there for a reason. Furthermore there are now plenty of properly designed languages that target simplicity and beginners, so really there is no excuse for using junk like PHP except having to maintain legacy code.

[phongn]

PHP was (and is) created by morons for morons. Fundamental technical flaws are the least of its problems. Greater is that the idiots around it don't see them as flaws.

Perhaps one of the few good things about PHP is that it does scale very well (as mentioned earlier) - but that is in spite of its many problems.

Its free, and it has been the mantra of a lot of geeks that Apache + PHP = Liberation...or something.

PHP was early, free, cross-platform and relatively easy to understand. There were not many alternatives when it was created (CGI scripts and Perl come to mind). Nowadays there are many alternatives - but PHP lets you get your feet wet early and is deceptively simple.

Mysql and secure? Don't make me laugh.

mysql_real_escape_string doesn't protect against against SQL injection properly with dynamic sql even ignoring unicode! Linky.

IIRC, most security sites specifically advice users not to use *escape_string for sanitizing. Also, MySQL is terrible - too bad Postgres made some bad decisions back in the day and let MySQL take the market.

Quite a lot of programming languages are someone's personal crappy scripting language that somehow escaped and gained popularity. These are kludged together with no real understanding of language, compiler or library design, and they universally suck. Perl is in this category despite massive efforts put in for over a decade to try and make it into a real language (why anyone would want to, I don't know).

Perl came early with the right features and the right price at the right time. Plus, there was strong demand for something to do string parsing and munging. Of course, now there's so much legacy code and so many Perl gurus they want "sane" Perl.

These languages are attractive only because they seem simple and easy to pick up. In actual fact, all the 'counterintuitive' and complex features in other languages are generally there for a reason. Furthermore there are now plenty of properly designed languages that target simplicity and beginners, so really there is no excuse for using junk like PHP except having to maintain legacy code.

Yeah, but it's popular, free and cross-platform so new people see it and dive right in.

[Terralthra]

Half of my development time with PHP is basically rewriting things I can't trust the php team to have done properly. I think this epitomizes it.

Incidentally, when you write things like

Code: Select all

 $arr = array ();

  for ($i = 0; $i < 100000; $i++)
    {
      $c = mt_rand (0,1);
      if (!isset ($arr[$c])) $arr[$c] = 1;
      else $arr[$c]++;
    }

  ksort ($arr);

  foreach ($arr as $key => $value)
    {
      echo '<b>'.$key.':</b> '.$value.'<br />';
    }

when you could write

Code: Select all

  $arr = array (0,0);
  for($i = 0 ; $i < 100000 ; $i++) {
    $arr[mt_rand(0, 1)]++;
  }
  foreach($arr as $k => $v) {
    echo '<b>'.$k.':</b> '.$v.'<br />';  
  }  

you lose the right to complain about poorly-written code.

[Ariphaos]

I can only have so much respect for people who equate poor optimization (especially for a pruned test case) with an actual failure of implementation.

Anyway.

Quite a lot of programming languages are someone's personal crappy scripting language that somehow escaped and gained popularity. These are kludged together with no real understanding of language, compiler or library design, and they universally suck. Perl is in this category despite massive efforts put in for over a decade to try and make it into a real language (why anyone would want to, I don't know).

These languages are attractive only because they seem simple and easy to pick up. In actual fact, all the 'counterintuitive' and complex features in other languages are generally there for a reason. Furthermore there are now plenty of properly designed languages that target simplicity and beginners, so really there is no excuse for using junk like PHP except having to maintain legacy code.

PHP gets out of the way. Far too early, but it has an installed base of pretty much Everywhere, and is getting slowly whipped into shape. It might take a fork to get a proper implementation, however.

Perhaps one of the few good things about PHP is that it does scale very well (as mentioned earlier) - but that is in spite of its many problems.

I suspect the concept is actually related. Because so much php code is hacked together, quite a lot of the most important parts (getting information from the database to the server) gets tweaked for speed. And occasionally they notice about security.

Yeah, but it's popular, free and cross-platform so new people see it and dive right in.

php.net's documentation is currently king. Pretty much the sole reason. Problem with anything? Look it up.

[Terralthra]

I can only have so much respect for people who equate poor optimization (especially for a pruned test case) with an actual failure of implementation.

It's not "poorly optimized," it's "badly written." It has extra control structures for no conceivable reason, which make it hard to read and understand, pointlessly. If you really, for some reason, didn't want to initialize the array when you declared it (I am guessing you started with a much larger array, due to the pointless ksort, and pruned it down to 0/1? Filling with 0 manually in that case would be tedious), $arr.fill(0) works just fine.

Yeah, but it's popular, free and cross-platform so new people see it and dive right in.

php.net's documentation is currently king. Pretty much the sole reason. Problem with anything? Look it up.

The fact that you have to read through the comments section with various posts of questionable expertise and veracity to answer most questions and read about known issues somewhat negates this.

[phongn]

Yeah, but it's popular, free and cross-platform so new people see it and dive right in.

php.net's documentation is currently king. Pretty much the sole reason. Problem with anything? Look it up.

PHP.net's documentation is not "good".

[Terralthra]

FUCK MY KEYBOARD WITH A BACK BUTTON NEXT TO THE SHIFT KEY

FUCK FUCK FUCK

It's not "poorly optimized," it's "badly written." It has extra control structures for no conceivable reason, which make it hard to read and understand, pointlessly. If you really, for some reason, didn't want to initialize the array when you declared it (I am guessing you started with a much larger array, due to the pointless ksort, and pruned it down to 0/1? Filling with 0 manually in that case would be tedious),

Think for a minute. His code is easily altered. If he wants to change the range of the random numbers generated, it is a one line change - the mt_rand arguments. He can punch in any values and it will just work.

Not so with any of your suggestions. Changing it from 0-5, for example, requires two lines changed: the mt_rand and the array constructor.

Moreover, your suggestion is needlessly wasteful of memory and performance, initializing an (associative) array that is never used.

Consider 10-20. In his code, change mt_rand and boom. On your code, what will you do? Construct a 20 element array and waste half the memory? Make it 10 elements and subtract 10 from the returned value? Lol.

Or, the most likely case: mt_rand() with no arguments, goes between 0 and RAND_MAX which is something like 2^31. Do you suggest that he allocate 2 GB * sizeof(php arr element) of memory up front?

Fucking lol, especially with only 100,000 iterations. Less than 1/1000 of that memory will ever even be used - it is sparsely and randomly populated. The very definition of where a lazy AA is meant to be used.


For the simple 0 and 1 case, your code is a bit nicer (saves two lines! woooo!) but for almost any other conceivable case, his code is vastly superior.


The real incompetence here is you throwing out the initial ad hominem (yeah, dismissing someone's points because of a "failing" in personal style is really logical. oh wait, it's a textbook fallacy) and then having your own defense of it lead the way to knocking you right on your ass, but you fail to see it! And you make the sweeping "inconceivable" claim.

Christ.

Finally, does php even have an arr.fill() function? I didn't think it did.

Not only does it have a fill function, it completely obviates your complaint, since the fill function can take as additional arguments the range of values you wish to fill. Want to do 10 - 20? $arr.fill(10, 20, 0). So, not only did the function you didn't think existed exist, it also does what you didn't think it could do.

If you think you could adequately test an RNG across a spread orders of magnitude greater than the number of iterations, I don't know where you learned statistics. A sparsely populated RNG test array would be meaningless. If mt_rand were between 0 and 2^31, he would doubtless have incredibly more iterations in order to have any meaningful results. And yes, said program would be a memory hog, either way.

His code is also harder to read. That is not a trivial complaint. That it has "more lines" is not the key point. It has extra control structures; moreover, these control structures do not actually reflect the logic of the code. This is bad on two levels. If he really wanted to be sure that "he only had to change it in one place" in order to run a different test case, he could put in defined constants and use them in both places. Note that this would be more lines, but more easily read yet.

[Ariphaos]

It's not "poorly optimized," it's "badly written." It has extra control structures for no conceivable reason, which make it hard to read and understand, pointlessly. If you really, for some reason, didn't want to initialize the array when you declared it (I am guessing you started with a much larger array, due to the pointless ksort, and pruned it down to 0/1? Filling with 0 manually in that case would be tedious), $arr.fill(0) works just fine.

The original code was testing a function that generated random strings of various lengths and levels of randomness, where certain characters are forbidden (cookie storage), and I was doing various tests on that. I didn't rethink it after adjusting the test case, it being a test case.

After I posted the code I realized it sucked and was wondering how long it would take for someone to bitch about it. It seems most people here are perfectly fine with assuming something completely different is going on from what is presented.

The fact that you have to read through the comments section with various posts of questionable expertise and veracity to answer most questions and read about known issues somewhat negates this.

It makes it of disputable quality, yes, but I was referring to its accessibility.

[Jeremy]

Approximately, how long would it take for me to read enough and have enough hands on experience to know how to do any of this?

The most advanced "code" I knew was how to set the background color in HTML and I don't really remember that right now. To the point, I have to take a COP 2220 course in the summer, what do I need to learn before putting my ignorant butt into it?

[phongn]

Approximately, how long would it take for me to read enough and have enough hands on experience to know how to do any of this?

Why not try it?

The most advanced "code" I knew was how to set the background color in HTML and I don't really remember that right now. To the point, I have to take a COP 2220 course in the summer, what do I need to learn before putting my ignorant butt into it?

COP 2220 looks like a basic introductory course: you should know how to use a computer.