Aniruddh Agarwal blogged A short tour of PHP, and this is one of the negatives he identified:
Community: I know. I said that PHPs community was an advantage to it, but it is also a disadvantage, because of BAD CODE. Beginners are not taught the best practices and they go on to write bad code and distribute it, either as answers on Stack Overflow or similar websites or blog about it, which encourages other beginners to adopt those practices. There is a lot of misinformation out there, and it is very difficult to separate the good from the bad. This is perhaps the worst thing about PHP, because PHP is an entry-level language and people learning it are usually not aware of the best practices.
The existence of BAD CODE being copied and pasted by newcomers is probably the biggest source of exploitable security vulnerabilities in the entire industry.
The biggest offenders are often the highest ranking search results on Google and other search engines:
- Old Stack Overflow answers
- Outdated yet popular tutorials
- Ancient blog posts
For the good of the PHP developer community and the future generations that have not yet joined our ranks, I believe it's high time we cleaned up our act. Neophyte developers should be more likely to run into secure, well-written code than swiss cheese written by people who don't understand application security.
Therefore, I propose the following strategy:
How do you safely store a password, server-side?
If you said anything other than scrypt, password_hash(), the PHC winner, or a well-written bcrypt-base64-sha2 class (e.g. password_lock or \Zend\Crypt\Password\BcryptSha), you are wrong.
Simply put: The less Google trusts bad websites, the lower they'll appear in the search results.
This might involve a mass takedown campaign, where everyone logs into their old message board accounts and replaces links to these shitty code dispensors with links to better solutions.
Explain the situation, request a preface/disclaimer for all of the security problems their old blog post can introduce into a project. If the blogger is clever, they'll write a new article explaining how to do it the 2015 way and link to that in their preface. If they don't have the time or energy, ask them to link to an external page that provides a better answer.
Ultimately, the proliferation of buggy and insecure code is only going to create more problems as time goes on. The wound is festering; it needs to be sanitized.
Let's Clean Up the Bad Code and Make the PHP Community Better.
Yes! 👍 I fully agree.
I'd like to also point out something I almost always get criticized for. When I try to help someone and I can see they are a real beginner and obviously have missed out on some important steps in their own learning development, like asking for solutions to a problem in a manner, which clearly shows they are way in above their heads from a programming experience standpoint, at that point I don't spoon feed them the solution they are asking for, but rather, I tell them to go back to learning what they need to learn to fix it themselves.
You see, I believe in
Too often sites like StackExchange, or any other online community with experts and helpers, motivate beginners to just throw out their problem like bait for a fish and too many good (and unfortunately sometimes bad) developers get hooked like a fish and simply throw back some solution. It is obvious though, the beginner can't even cast right.
The better answer is to simply ask the beginner to go look through teachings and not give them the direct solution. They should work out the answer for themselves. They should learn. This is especially true, when the problem/ question is formed in such a way that it is very clear the beginner didn't even try to find a solution on their own. That often gets an answer from me like, "Did you even try to solve the problem yourself?"
At any rate. My rule is, try to teach first and only give final solutions, when the person asking has obviously tried to solve the problem on her own and has an obvious grasp of at least some of the overarching concepts needed to understand the problem to begin with.
Scott