PHP is our prefered tech stack

A Little History

PHP, or Hypertext Preprocessor, is a widely used open-source scripting language that has been powering the web for more than two decades. Originally created by Rasmus Lerdorf in 1994 as a scripting language to make web development easier, PHP has come a long way in terms of features, security, performance and accommodating modern programming practices.

Prior to PHP, dynamic web pages were difficult to built.  The typical approach was using a CGI gateway to interface with a C program requiring lower-level programming and additional steps to handle web requests and responses, making the process complex and error-prone. So even processing a contact us form required support from a skilled C developer.  PHP is a high-level scripting language specifically designed for web development, making it more intuitive and user-friendly for developers.  No compiling,memory management or other low level programming skills required. 

 

Some Key Benefits of PHP

Easy to Learn and Get Started: PHP's syntax is clear and concise, making it accessible for beginners. As a scripting language, PHP allows newcomers to quickly grasp the fundamentals and start developing web applications with minimal training. This ease of use has contributed to PHP's widespread adoption and continued popularity among developers.

Cost-effective and Open-source: PHP is an open-source language, which means that it's available for free. This makes it an ideal choice for businesses looking to minimize development and support costs.

Strong Community Support: The vast PHP community ensures a wealth of resources, such as tutorials, documentation, and forums, all available to help developers troubleshoot issues and optimize their code.  With millions of developers worldwide, PHP has a robust community that actively contributes to its growth and development.

High Performance and Scalability: For a scripting language, PHP is very fast, particularly when combined with modern web servers like Apache or Nginx. PHP 7 and PHP 8 both introduced significant performance improvements, making it a competitive choice for building high-traffic websites and web applications. Additionally, PHP's scalability ensures that applications can grow and adapt to increased user demands without major performance hiccups.

Cross-platform Compatibility: PHP is a platform-independent language, which means it can run on various operating systems, including Windows, macOS, and Linux. This cross-platform compatibility enables developers to create web applications that can be deployed on any server environment without requiring extensive modifications. Furthermore, PHP works seamlessly with a wide range of databases, such as MySQL, PostgreSQL, and SQLite.

Flexibility and Customization: PHP offers an incredible level of flexibility, allowing developers to build bespoke web applications tailored to specific business requirements. The language supports a wide range of design patterns and architectural styles, providing developers with the freedom to create customized solutions.  PHP has stretched well beyond a basic web scripting language, it runs on the command line making it easy for PHP developers to write system scrips as well as web pages.

 

The Haters

The most commonly cited problem relate to PHP’s inconsistent function naming.  Most examples of inconsistent naming have come from PHP closely mapping functions provided by C Libraries.  Rather than invent completely different functions Rasmus elected to keep PHP as compatible as possible with the underlying C Libraries.  So arguably PHP is consistent because if follows the patterns of an other established language.

Another reason for PHP to get hated on is the lack of modern programing features such as Object Orientation, Type hinting, and name spaces.  I am happy to argue the people who maintain PHP do an excellent job of adding new programming language features at a good pace.  And over time obsolete features and practices are depreciated and eventually removed. My PHP experiences started with PHP 3 and we are currently on PHP 8.  Only the basic syntax is still the same these days, new features such as Object Orientation, exception handling, null safety, Namespaces, auto loading mean modern PHP code usually looks quite different from code written 20 years ago.  PHP cannot be evolved much faster because organisations with large code bases will struggle to keep up with the latest releases.

A couple of features haters like to bring up are magic quotes and register globals.  Magic quotes automatically add backslashes to certain characters in user input to prevent SQL injection and other issues. However, this approach has been found to be unreliable and lead to inconsistencies in data handling. It could cause data to be unintentionally modified or improperly stored.  Register globals allows the use of variables without explicit declaration, which can lead to code injection attacks and other security vulnerabilities. An attacker could manipulate the values of these variables and execute arbitrary code on the server.  Both these features existed in early versions of PHP for the sole purpose of making PHP easier, remember PHPs original purpose was to make web programming easier.  The two features have long since been depreciated as the risks out way the benefits.

 

Security

Security is another often cited issue.  Hacks on PHP sites and applications are numerous, however this is mainly due to the popularity of PHP rather than issues with the language itself.  Due to its popularity, PHP applications are often targeted by attackers who have developed specialized tools and techniques to exploit common PHP vulnerabilities. These attackers know that there's a higher likelihood of finding vulnerable PHP applications compared to less popular languages.

Large user base: With a large number of users and developers, there are more opportunities for mistakes and misconfiguration that can lead to security vulnerabilities. The more PHP applications are out there, the higher the chance that some will have security flaws.

Legacy code and outdated practices: PHP has been around for a long time, and many older PHP applications may still be using outdated practices or insecure code. These legacy applications can be more vulnerable to attacks due to the use of deprecated functions, insecure libraries, or lack of modern security measures.

Inexperienced developers: Because PHP is a popular choice for beginners, many developers may not yet have a deep understanding of secure coding practices. This can lead to code that is more vulnerable to attacks and exploits.

Wide range of third-party components: PHP's popularity means that there is a vast ecosystem of libraries, plugins, and frameworks available for developers to use. While this can be a strength, it also increases the chances that developers may inadvertently use components with known security vulnerabilities.

 

So why do we stick with PHP?

PHP is certainly flawed, but it’s worth remembering that it is used for serving web pages.  It was designed to be easy to use for beginners and has evolved to keep up with the times.  PHP is not intended for life critical applications like missions to Mars.  PHP works fine for producing commercial web applications, and has been used by massive platforms such as Flickr, Wikipedia and Facebook.

Our main reason is our desire to specialize in a language and technology stack.  We do not jump on the band wagon of whichever programming language or framework is popular in the day.  We want to be the experts in a single stack.  When I started my own company in 2002, for me the choice was between Microsoft .net or PHP LAMP stack.  Both platforms offer a complete web application framework and both have lasted the test of time.  If I was starting from scratch today,  with no need to support our existing customers, it would be a toss up between a PHP LAMP stack or a Node JavaScript stack.  Again, the trick is picking a language which will still be used in 20 years time!