Skip to content

Instantly share code, notes, and snippets.

Created May 30, 2015 04:25
Show Gist options
  • Save sarciszewski/83a0bb133bdc7455e5db to your computer and use it in GitHub Desktop.
Save sarciszewski/83a0bb133bdc7455e5db to your computer and use it in GitHub Desktop.
A Crusade Against Bad Code

Aniruddh Agarwal blogged A short tour of PHP, and this is one of the negatives he identified:

Community: I know. I said that PHPs community was an advantage to it, but it is also a disadvantage, because of BAD CODE. Beginners are not taught the best practices and they go on to write bad code and distribute it, either as answers on Stack Overflow or similar websites or blog about it, which encourages other beginners to adopt those practices. There is a lot of misinformation out there, and it is very difficult to separate the good from the bad. This is perhaps the worst thing about PHP, because PHP is an entry-level language and people learning it are usually not aware of the best practices.

This is spot on!

The existence of BAD CODE being copied and pasted by newcomers is probably the biggest source of exploitable security vulnerabilities in the entire industry.

The biggest offenders are often the highest ranking search results on Google and other search engines:

For the good of the PHP developer community and the future generations that have not yet joined our ranks, I believe it's high time we cleaned up our act. Neophyte developers should be more likely to run into secure, well-written code than swiss cheese written by people who don't understand application security.

Therefore, I propose the following strategy:

Fix the bad advice on Stack Overflow.

How do you safely store a password, server-side?

If you said anything other than scrypt, password_hash(), the PHC winner, or a well-written bcrypt-base64-sha2 class (e.g. password_lock or \Zend\Crypt\Password\BcryptSha), you are wrong.

Stop Linking to W3Schools, PHPClasses, HotScripts, etc. Start Linking to Better Solutions.

Simply put: The less Google trusts bad websites, the lower they'll appear in the search results.

This might involve a mass takedown campaign, where everyone logs into their old message board accounts and replaces links to these shitty code dispensors with links to better solutions.

Contact Bloggers and Tutorial Authors

Explain the situation, request a preface/disclaimer for all of the security problems their old blog post can introduce into a project. If the blogger is clever, they'll write a new article explaining how to do it the 2015 way and link to that in their preface. If they don't have the time or energy, ask them to link to an external page that provides a better answer.

Ultimately, the proliferation of buggy and insecure code is only going to create more problems as time goes on. The wound is festering; it needs to be sanitized.

Let's Set Better Examples for Developers To Learn From

Let's Clean Up the Bad Code and Make the PHP Community Better.

Copy link

ckrack commented May 30, 2015

This is a huge problem.

What really makes me shiver, is when companies that provide an API publish example code of bad quality.
People will always start with the example code and mistakes introduced there will appear in their production code.
That has been the case for the paypal api a couple of years ago for example.

Copy link

ghost commented May 30, 2015

Interesting points. This isn't a problem unique to the PHP world though. I mainly live in the microsoft/.net world and I've recently turned my attention to PHP. You describe a problem that I don't think has an easy solution. We need more mentoring in the industry. But companies usually want to hire the cheapest guy. Sometimes the cheapest guy might not know anything, but is really good at putting on a show. Now we have a proliferation of these boot camps that churn out developers in a matter of weeks. I'm a little worried about the future of software engineering based on current trends. Computer science enrollment was down for nearly a decade. There's going to be such a knowledge gap in the industry soon once the true senior software engineers begin to move into retirement.

Copy link

sbokul commented May 30, 2015


Copy link

As a sitepoint Ambassador.... i'm in lets Clean up our mess

Copy link

I'd like PHP The Right Way to split into multiple URLs so they can be linked to and ranked more specifically on Google than the current #anchor approach.

If anyone is interested, the repo is here:

Copy link

This PR is quite on point with your message

Could be cleaned up a bit

Copy link

Aaaand this is very old too but in the same vein codeguy/php-the-right-way#341

Copy link

@philsturgeon Given that there are 10 unresolved pull requests in codeguy/php-the-right-way, I'd hesitate to send one that breaks them all until they can be merged or closed.

Copy link

As the Editor-in-Chief of Zend's DevZone, I am 100% behind this.

We recently re-launched DevZone and while we do have a lot of old content up, anything that is more than 3 years old carries a warning at the top letting the reader know that it is there for archival purposes only.


Copy link

W3 Schools gets a lot of hate, but there are few good resources out there like it that target absolute beginners.

Copy link


Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment