codeguy/php-the-right-way — pull request #32 by joepie91 (2012-07-08 23:49:06+00:00)
Title: Several changes

I've made several changes to the document:
* Make the coding style focus on readability, rather than 'common usage' - the former is far more important. Many common code styles include seriously bad habits that are hard to un-learn... exactly _because_ they are so common (an example would be variables in strings without curly braces around them).
* Explain how to deal with legacy code using (deprecated) mysql_ functions - it is not unlikely that a developer will run across old code, and he should know how to sanitize it if he ever happens to have to modify the code.
* Added a warning to the namespace section, since many (especially shared) environments still run a version of PHP that does not support namespaces.
* Fixed the filtering section - filtering _before_ database insertion is a horribly bad idea, as it results in mangled data in the database. Always store original untouched data, and process as needed at the moment you are about to use it.

Some other issues that should really be considered:
* bcrypt has a (virtually undocumented) character limit of, I believe, around 40 characters. Passwords longer than this are silently cut off. This makes it a bad idea to use it. In my opinion something along the lines of SHA-256 or SHA-512 with many rounds would be a much better solution since there is no arbitrary character limit (this can be done with the crypt() function).
* The style guides that are mentioned, seem to originate from a very small survey that is only based on common usage. No reasoning behind certain recommended styles is included, and it's basically 'majority rule'. This makes the guides, in my opinion, virtually worthless - they do not promote readability, they simply propagate common style.
* From what I understand, the various 'package managers' only work if you have actual shell access on a server. Many PHP developers use shared hosting environments and will as such not be in a position to use these package managers. That issue should be addressed.
* Frameworks. Aside from MVC frameworks (which is what the list seems to consist of mostly) being horribly unsuitable for a language that is structured (or rather, unstructured) like PHP, the article only gives a list of some frameworks without any elaboration as to what each framework does, what the differences are, etc. Either this section shouldn't be there to begin with, or it should give more information.
* The OWASP guide does not deal with PHP specifically. While it is a good reference, there should really be a PHP-specific reference that also explains what functions to use, etc. In the current situation, users can at best guess what function to use - and considering the mess that is PHP, that is pretty likely to go wrong.