Re: sql injections/best practises

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Nov 10, 2008 at 8:49 AM, mignon hunter <fmh102560@xxxxxxxxx> wrote:
> One other question. Our current site is written in jsp with Oracle. I'd like to use PHP. Do you have any thoughts on this?

Your post, mignon, was pretty clearly directed to Christopher, but I
hope neither of you will be unhappy if I make my own comment.  I look
forward to seeing what Christopher thinks as well, but I do have some
thoughts on this.

First, I will say that I have never worked with JSP.  I have worked
with Java, and I rather enjoy it, but I have not travelled down any of
the JSP trail.  For that reason, I'm not going to attempt to assess
JSP specifically, other than to say that it seems rather more
time-consuming to learn than PHP.

There is a simple reason that I choose PHP exclusively for web
development.  It has nothing to do with any intrinsic value of PHP.  I
actually think PHP is the worst designed platform I've ever worked
with.  There is so much about it I really don't like.  But it has one
overriding strength: it's everywhere.  It's simple to integrate with
any server, it's widely available, and hosting for other technologies
like JSP, Ruby, and Python tends to be more expensive than PHP.  And
don't even get me started on ASP and ASP.Net, which are only truly
supported on (shudder) MS servers.

Now all of this said, I am leery of your idea to switch to PHP for
this application you are working on.  If you're not planning to move
servers, the wider support for PHP isn't an advantage at all.
Switching technologies because you think PHP is somehow cooler is a
poor justification for what could be a costly exercise for the client,
so you ought to have a really practical explanation.  Why don't you
want to continue working with JSP?  Is there really a problem in using
that platform?


> We're not really using Jsp as it was intended ( like using classes ) and I think it has alot of overhead and is overkill. It seems Php would
> be a better choice for imbedded html.

This is probably true, but I am no authority on JSP.  But in most
cases, embedding PHP in HTML is not a best practice.  Most
professionals agree that there is a real value in separating
presentation (HTML in this case) from logic (the PHP code).  This is
something all the frameworks attempt to help you do.  This same idea
was the impetus for the rise of model-view-controller (MVC) design
pattern, its later application to web projects, and the development of
Cascading Stylesheets (CSS) to separate presentation of web content
from structure (HTML).

As I mentioned previously, I am a little reluctant to use frameworks.
For this reason I have implemented my own simple template script that
allows me to put all my PHP logic in one file and all my presentation
in a separate template file.  My approach is similar to that of Brian
Lozer.  Brian is the author of bTemplate, but abandoned its
development when he hit upon the real weakness in template engines and
frameworks.  Here's a link to his article on the subject.  I'm not
suggesting anyone use bTemplate; I'm encouraging people to understand
why he decided it wasn't productive to use a convention template
engine in the first place.

http://massassi.com/php/articles/template_engines/

All the above notwithstanding, there's always an argument for saying a
script is so simple the benefits of abstraction or design patterns or
MVC are not of much value.  But I think there are very few
applications where this is true, and worst of all, I tend to find that
even if you start off thinking that something is so simple and
straightforward you should just bang it out in the most simple and
direct way, you'll end up regretting it because the concept wasn't as
simple as you thought or because the client keeps adding on to his
original goal for the script 'til it becomes a messy monster you
wished you designed properly in the first place...

-- 
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [PHP Users]     [Postgresql Discussion]     [Kernel Newbies]     [Postgresql]     [Yosemite News]

  Powered by Linux