PHP as a Blunt Instrument
I hear PHP getting bashed around a lot lately. In quite a few projects, I have seen insane php code bases - so bad you really wonder if the person was on hallucinogenic drugs when they wrote the code. Sometimes, I wonder what the code would have been like if the initial developers had a bit more guidance as to what not to do.
However, I have also seen some very well organized PHP projects that were done in 100% OOP and were a pleasure to maintain, but they were not written by "php programmers."
I give all of our junior devs a link to Java Anti-Patterns. One of the nice things about that page is the Java-specific examples because there are many features of Java that lend themselves to common mistakes. I was hoping to find a similar list for php, but a google search did not reveal anything meaningful.
There are a few questions already out there for what a developer should know when programming PHP, but I wanted to focus on the negative.
What are the common things you have seen in PHP that should be avoided and what is a common solution to doing the same thing in a better way?
Some of the obvious examples to me that I think will be mentioned but aren't PHP specific:
- Don't concatenate SQL. Use prepare statements or proper escaping.
- Don't blindly embed PHP into HTML - use templating/MVC.
- Don't blindly post raw unfiltered user input - scrub it for XSS attacks.
- Don't manually try to parse all of your POSTs and GETs - use a web framework.
Here would be some examples that I would consider PHP specific:
- Don't have too many layers of file include/require linking and try to avoid conditional linking. Rather, have a sane naming convention and be consistent wi