ZEzelphirkalt·Apr 11, 2024
I took a look at https://github.com/aaviator42/izi/blob/main/izi.php. Basically the first repository that was listed. It looks a lot like what I wrote years ago, which unfortunately, in my book is not a positive. What I take issue with are the following things.
iniSettings();
enforceHTTPS();
session_start();
Global state things directly exposed to the user (programmer in this case). The problem here is, that this kind of thing immediately fails, when things start to use concurrency of any kind, because suddenly one has multiple processes concurrently setting global settings, without any kind of mutex in between. But this seems firmly part of the language??? That is worse! Because it encourages people to use global state just like this.
if(isset($_GET["m"]))
Apparently it is still common practice to have such "if bla is s
Read the rest
et, when do blub" everywhere in ones code? No functions with decorators or a similar or alternative concept? I would think there should be some kind of easy to use mechanism in place, that tends to avoid forgetting these ifs.
There are ... 60 lines of global logic, that is not encapsulated in any function or so?
Some of the functions are quite long. But I think mostly because they render out HTML.
At line 107 with the procedure printHeader starting, what I call PHP nightmare starts:
Switching back and forth between PHP, HTML and HTML with integrated JS (!!!) and CSS. All of course without syntax highlighting, but that is a minor issue. The major issue is treating HTML and JS and CSS as mere strings, instead of structured data, and the very bad readability of having procedures suddenly "end" and spit out some wild HTML, then suddenly continuing again, because some server side logic/decision is required at some place in that stream of unstructured data, whether some part is to be included or not, then the stream continues and then at some point one needs to actually check, that one did not forget to truly end the procedure. This has some of the worst readability. Maybe C code with bit magic is worse.
One can find this kind of approach in many, if not most, Wordpress plugins. What's more is, that this is also terrible for writing tests. The procedures do not return a value to check against. All is a side effect. Perhaps there is some PHP library that manipulates the PHP system, so that one can at least do string comparisons on the side effects. Like mocking, basically. But still terrible for testing.
For a comparison of how it should be done instead, check any templating engine, that at least separates template files from PHP code. Better, checkout SXML libraries, that treat HTML as structured data, a tree that can be traversed and pattern matched against, without pulling out arcane string manipulations or regular expressions. And then consider how one could write tests based on such structured data.
If this "HTML is a string, even on the server side before sending it" kind of approach is how a language treats HTML, then the language is not suitable to be directly used for HTML templating, without any additional library. This alone has caused uncountable security issues in so many projects.
I realize, that this is probably kind of a "one off script" and may not reflect other kinds of PHP code.
I did all of those things myself, years ago. And when I already had moved away from such an approach, I had to maintain a project, that was written this way. It had no tests of course. No fun. It has not that much to do with you personally being a good dev or not. I think it has to do with the ecosystem encouraging you to do these things. Outputting HTML like that should be declared illegal and should be impossible.
https://github.com/aaviator42/StorX/blob/main/StorX.php in comparison looks much better. It seems it does not output things directly. Everything seems wrapped nicely into methods. One obvious footgun seems to be another global state thing, that I really hope is not a thing in PHP itself:
const THROW_EXCEPTIONS = TRUE;
Please, please tell me, that this is not an official part of PHP itself.