With PHP's widespread adoption,it's almost too easy to find a script or snippet to do exactly what you need. Unfortunately, there's no filter as to what is a "good practice" and what's, well... not so good when writing a PHP script. We need trustworthy sources, who have proven they have a solid grasp on the best practices of PHP.
We need PHP masters to show us the best principles to follow for high-grade PHP programming.
There's no better resource than PHP's creator for knowing what PHP is capable of. Rasmus Lerdorf created PHP in 1995, and since then the language has spread like wildfire through the developer community, changing the face of the Internet. However, Rasmus didn't create PHP with that intent. PHP was created out of a need to solve web development problems.
And as with many open source projects that have gone on to become popular, the motivation was never philosophical or even narcissistic. It was purely a case of needing a tool to solve real-world Web-related problems. In 1994 the options were fairly limited when it came to Web development tools.
However, you can't use PHP for everything. Lerdorf is the first to admit that PHP is really just a tool in your toolbox, and that even PHP has limitations.
Use the right tool for the job. I have run across companies that have completely bought into PHP, deploying it absolutely everywhere, but it was never meant to be a general-purpose language appropriate for every problem. It is most at home as the front-end scripting language for the Web.
Trying to use PHP for everything isn't efficient, and it certainly isn't the best use of your time as a web developer. Don't be afraid to to use other languages if PHP isn't working out for your project.
Nobody needs to question Matt Mullenweg's authority with PHP. He has, (alongside a rabid community), developed the most popular blogging system on the planet: Wordpress. After creating Wordpress, Matt and company launched the stellar Wordpress.com, a free blogging site based on the Wordpress MU code base blogging software for multiple blogs. At the time of this writing, Wordpress.com hosts over 4 million blogs, and their users have written over 140,000 posts today. (You can see more interesting stats about Wordpress.com usage here.)
If anybody knows how to scale a website, it's Matt Mullenweg. In 2006 Matt gave some insight into Wordpress' database structure and explained why Wordpress MU uses a separate MySQL table for each blog, as opposed to using one giant "monolithic" table for all of the blogs.
We tested this approach for MU, but found it was too expensive to scale past a certain point. With monolithic structures you hit a wall based on your hardware. In MU users are divided and can be partitioned easily, for example on WordPress.com we have the users partitioned between 4096 databases, which allows you to scale very cheaply and efficiently to hundreds of thousands and even millions of users and extremely high levels of traffic.
Being able migrate the tables allows the code and ultimately the blogs to run much faster and scale easier. Alongside some heavy caching, and smart database usage, Matt has shown that extremely popular sites like Facebook and Wordpress.com can run off of PHP and handle the incredible traffic load.
Dave Child is the brainchild (teehee) behind the recently renamed Added Bytes (previously ilovejackdaniels.com) website that featured Dave's excellent cheat sheets for many programming languages. Dave's worked for many development companies in the UK and has established himself as an authority in the programming world.
Dave offers some sage advice when it comes to writing secure code in PHP: Don't trust your users. They just might hurt you.
So the cardinal rule of all web development, and I can't stress it enough, is: Never, Ever, Trust Your Users. Assume every single piece of data your site collects from a user contains malicious code. Always. That includes data you think you have checked with client-side validation, for example using JavaScript. If you can manage that, you'll be off to a good start. If PHP security is important to you, this single point is the most important to learn.
Dave goes on to give specific examples of secure practices in parts one, two and three of his 'Writing Secure PHP' series. But his ultimate takeaway is this:
Finally, be completely and utterly paranoid. If you assume your site will never come under attack, or face any problems of any sort, then when something eventually does go wrong, you will be in massive amounts of trouble. If, on the other hand, you assume every single visitor to your site is out to get you and you are permanently at war, you will help yourself to keep your site secure, and be prepared in case things should go wrong.
Ben Balbo has been writing for Site Point, a very well respected tutorial site for the likes of developers and designers. He's on the committee for both the Melbourne PHP User Group and Open Source Developers' Club, so he knows a thing or two about the language. It's no surprise with Ben's background as a PHP developer and trainer that he recommends putting a little more thought and preparation into PHP caching.
If you have a busy and predominantly static web site--such as a blog--that's managed through a content management system, it will likely require little alteration, yet may benefit from huge performance improvements resulting from a small investment of your time. Setting up caching for a more complex site that generates content on a per-user basis, such as a portal or shopping cart system, will prove a little more tricky and time consuming, but the benefits are still clear.
There are many different techniques for caching in PHP, and Ben touches on a few of the bigger ones in the article, like:
and many others. Because of the nature of dynamic languages like PHP, caching is critical to store those parts of the page that are accessed frequently and don't change often.
When Chad Kieffer isn't busy rocking user interfaces and administering databases, he's giving expertise advice from his blog 2 tablespoons. Because of Chad's wide field of expertise, he's often able to see the big picture that other programmers might not, specifically when it comes to the holistic approach that Chad takes to developing a website. He specializes in all aspects of the development process, so any insights he can provide with putting together an entire project is going to be useful.
Chad believes that using an IDE like Eclipse PDT (Eclipse's PHP development package) with a mixture of templates and snippets can really speed up the turnaround time on a project.
Busy schedules, long to do lists, and deadlines make it tough for developers to get familiar with some of the advanced features their tools provide. This is a shame, because some features, like Eclipse Templates, can really reduce coding time and errors.
Common sense says that any time you can automate a task, the quicker you'll get the project done. The same holds true with Dan's theory. By taking the time to create templates that you'll use over and over, you'll save tons of time automating the repetitive parts of coding.
By using an IDE like Eclipse and the PDT package, you'll find that your development time will incrementally speed up. The IDE will auto-close brackets, add those missing semicolons and even allow you to debug within the editor, without having to upload to the server. (Chad has a nifty tutorial on getting started with Eclipse PDT and the benefits of an IDE in general, if you're interested.)
While Joey Sochacki may not be as big of a name as Matt Mullenweg in the PHP community, he's a seasoned web developer and shares tips that he's picked up along the way at his blog Devolio.
Joey has found that even though there is a ton of filtering that has to happen when writing PHP code, not many programmers make use of PHP's filter functions.
Filtering data. We all have to do it. Most, if not all of us, despise doing it. However, unbeknown to most are PHP's filter_* functions, that allow us to do all sorts of filtering and validation. Using PHP's filter_* functions, we can validate and sanitize data types, URLs, e-mail addresses, IP addresses, strip bad characters, and more, all with relative ease.
Filtering can be tricky, but this guide can help immensely. With Joey's help you'll learn how to install the filters and and filter nearly anything, taking advantage of the filtering power of PHP.
There has always been a debate as to whether to use a PHP framework like Zend, CakePHP, Code Igniter, or any other framework. There are upsides and downsides to using one, and many developers have their own opinions about whether or not to go down this road.
Josh Sharp is a web developer who makes his bread and butter creating websites for clients. This is why you should trust him when he says it's a good idea to use a PHP framework to save time and eliminate mistakes when programming. Why? Josh believes it's because PHP is too easy to learn.
But PHP's ease of use is also its downfall. Because there are less restrictions on the structure of the code you write, it's much easier to write bad code. But there is a solution: use a framework.
PHP frameworks help standardize how you program, and can save lots of time in the development process. You can read more about the benefit of using a PHP framework at Josh's blog.
Contrary to Josh's belief that one should use a PHP framework, Rasmus Lerdorf, the Godfather of PHP himself, believes that frameworks aren't that great. Why? Because they perform much slower than simple PHP.
During Rasmus' presentation at Drupalcon 2008, Rasmus compared the response times to a PHP page with a simple "Hello World" example, and compared it to a few PHP frameworks (slides 24-32), and showed that PHP frameworks are much slower than straight PHP.
You can listen or watch the entire presentation where Rasmus shows the performance losses with PHP frameworks. In short, Rasmus shows that performance takes a major hit when you use a PHP framework as opposed to using pure PHP.
[Note: If you have to use a PHP framework, Rasmus likes Code Igniter the best, as it is "least like a framework"]
Jack Herrington is no stranger to PHP and the development world. On top of writing over 30 articles for the prestigious IBM developerWorks, Jack has also published programming books like PHP Hacks. Jack is a bona fide expert.
Herrington recommends using batch processing and cron to tackle those tasks that can process in the background. Web users don't want to wait long for tasks to complete on the web. There are some jobs that take longer that are much more suited to being done in the background.
Certainly, in some small cases, it's a bit easier to fire off of a helper thread to handle small jobs. But it's easy to see that with the use of conventional tools -- cron, MySQL, standard object-oriented PHP, and Pear::DB -- creating batch jobs in PHP applications is easy to do, easy to deploy, and easy to maintain.
Jack believes in simplicity, and instead of using threading on servers, he uses the simple combination of cron, PHP and MySQL to process tasks in the background.
I've done both, and I think cron has the advantage of the "Keep It Simple, Stupid" (KISS) principle. It keeps the background processing simple. Instead of having a multithreaded job-processing application that runs forever and, thus, can never leak memory, you have a simple batch script that cron starts. The script determines whether there's anything to do, does it, then exits. No need to worry about memory leaks. No need to worry about a thread stalling or getting caught in an infinite loop.
David Cummings runs his own software company that specializes in content management systems, and has won several awards. If anyone knows how to develop a PHP application efficiently, it's Dave.
David wrote in a SitePoint article about the two PHP tips he wished he'd learned in the beginning. One of the tips: Turn on error reporting immediately. It'll save a great deal of time in the long run.
The single most important thing I tell people who use PHP is to turn error reporting to its maximum level. Why would I want to do this? Generally the error reporting is set at a level that will hide many little things like:
- declaring a variable ahead of time,
- referencing a variable that isn't available in that segment of code, or
- using a define that isn't set.
These factors might not seem like that big a deal -- until you develop structured or object oriented programs with functions and classes. Too often, writing code without error reporting turned up high would cost you hours as you scoured long functions that didn't work because a variable was misspelled or not accessible.
Error reporting can make finding the reason for an error much easier. A tiny bug in the code can be quickly identified if PHP's error reporting is turned on high. Save yourself some time and hair pulling by letting PHP find your bugs for you.
Read the previous post in this series: 10 Principles of the CSS Masters.
Glen Stansberry is a web developer and blogger who's struggled more times than he'd wish to admit with CSS. You can read more tips on web development at his blog Web Jackalope.
Check out some more great tutorials and articles that you might like
We pay $150 for user submitted tutorials and articles that we publish. Anyone can send in a contribution
Community Link Feed
User Comments
( ADD YOURS )Jay September 8th
Great read. Thanks.
Ihab Khattab September 8th
Wonderful article.
There is a typo it is “CodeIgniter ” not “Code Ignitor”
Niklas September 8th
Splendid article! Always useful to read abouth the most useful and best principles. Thank you!
Dan September 8th
I was just told about that last one, and it’s already saved me hours.
Dave Child September 8th
Great advice here, and thanks for including me in such redoubtable company!
I’d add a quick note to point 10 - use XDebug if you can. It provides stack traces, which are invaluable for turning PHP’s rather terse error messages into something you can better use to track down problems. (It also allows you to identify bottlenecks through profiling a PHP app and provides code coverage reporting if you’re using unit testing.)
Shane September 9th
Interesting list, thanks.
I agree with your opening comments about it being ‘almost too easy to find a script or snippet to do exactly what you need’. In many ways, this is similar to javascript.
It’s knowing what’s decent, as there is a lot of - ahem - crap out there.
Sean Nieuwoudt September 9th
Good article,
I agree with Rasmus about CodeIgniter. Great framework, easy to get started and fast.
Good to see I’m in the right direction.
Sean
James September 9th
One question, what’s with all the famous paintings?
KAZI September 9th
Great article, thank you.
Ben Griffiths September 9th
Some good points there, thanks
Michael Wales September 9th
Not to nitpick - but in #7, it’s CodeIgniter.
Great article though - I’ve definitely bookmarked a few of these articles to come back and review when I have the time. Many of them I have yet to see.
Shane September 9th
@James - PHP masters - Art masters?
Plus, it brightens up the post
Vijay September 9th
Hi,
Thanks for the great article. I agree with Josh when he says we must use a framework. Frameworks definitely help in reducing development time. My personal choice is symfony.
Thanks
Vijay
Tony Murphy September 9th
Hi,
This is a nice set of rules to start the day with. Agreed that its too easy to just pick up a script and hack it into working. Good practice always pays dividends in the medium to long term.
My favourite is “Don’t Use A Framework,” as Einstein said “simple but not too simple,” ie by trying to make it too simple it actually becomes complex, at least thats my interpretation
cheers
Tony
Sam September 9th
Please fix CodeIgnitOr -> CodeIgnitEr.
Jay Salvat September 9th
Brillant article. Thanks, I digg it.
design September 9th
10 wonderful PHP tips from PHP masters.
vladocar September 9th
Love the paintings! Great Article!
Robin September 9th
These are all excellent tips and admittedly one or two are new two me. First article I’ve read like this in years that’s actually good.
Ivan September 9th
If Rasmus says jump - will you jump?
Yeah, PHP frameworks perform slower then PHP itself. Frameworks aren’t made to be fast, they’re made to help you build your apps faster.
No wonder PHP is loosing to Ruby (read: Rails) - when the guys that created it are still in the stone age.
insic September 9th
Very helpful article. By the way theres a typo error in #7 its code igniter not code ignitor.
Lukas September 9th
CodeIgniter and not Code Ignitor
Brandon September 9th
Rasmus still looks at php as a scripting language that should only be used when absolutely necessary. He dislikes MVC based frameworks and believes performance trumps development speed and flexability. He has a very limited view on php but makes very good points when it comes to personal sites. If you are planning on only having a personal site that shows off some pictures or something of that nature, then yes, don’t use a framework. The overhead of a framework on a personal site will drive anyone mad (I’ve tried it with CakePHP, CodeIgniter, and symfony).
If you are building an enterprise level application, you are expecting more than 500 visitors a day, you have large amounts of data to display, and there are complex uses of databases, that is when you need a framework like symfony. I do mention symfony implicitly mainly from the fact that it is very much like Rails and Drupel. It seems to take the best parts of all of the frameworks and place it all into one complete package. It might be a little more complex than the other frameworks but it is also the most powerful and complete.
Jonathan September 9th
That was a great read. Found it very insightful. Really like the writing-secure-php part. Will have to investigate that further.
Jake Holman September 9th
I really love these Tutorials that are backed by quotes taken directly from well established developers. Really, it adds more merit than any other type of tut, because it doesn’t adhere to one guys thoughts about how something should be done.
It’s tutorials like this that offer those who are new to PHP the understanding of why we should standardise what we do when coding.
Thanks
Paul Gendek September 9th
This article was great! Really focuses on the professional development of PHP, and hopefully pushes hobbyists in the right direction!
curtis allen September 9th
thank for all the good information guys
Stefan September 9th
Nice tutorial! Thx
Evan September 9th
Love it! Awesome article on my favorite subject!
Georgi September 9th
Very true. To read that from Rasmus was pretty insightful for me. Could you just do me one more favor please? Post this one to our customers. ;- )
Miglen September 9th
Great article but i think that error_reporting should be only E_ALL when you developing and testing and should never be turned on in the real web application but that`s just my opinion.
Matt September 9th
Thanks for the shout-out.
Johan Martin September 9th
I agree with Josh Sharp that using a framework really helps to give you structure and helps build websites faster. If the only concern for not using a framework is speed, you shouldn’t use PHP either since C or machine code would probably be even faster.
Ozh September 9th
Interesting article. And beyond this, perfect example of the widespread habit consisting in plastering irrelevant and useless pictures everywhere in hope that the article will look cooler.
Miles Johnson September 9th
This was a pretty weak article, sorry.
I work with many advanced php gurus that know all about scaling, optimizing, server maintenance and more, and they know more then some of these people (wordpress for example). Just because someone is on the internet preaching about php, does not mean they are amazing at it. Have you looked at wordpress code? Its garbage.
Most of these are common knowledge (filtering, security, cacheing, error reporting, etc). Some of these are only for an individuals tastes (frameworks). Personally I find all frameworks bloated and slow, id rather build my own system that is attuned to my tastes and my structure.
Maicon September 9th
I will invest hours reading this amazin links =) Thank you very much.
Braden Keith September 9th
“Use PHP framework …. Don’t use PHP framework.” hahaha, that’s hilarious.
I really enjoyed the link to addedbytes. Good stuff going on over there.
Nate September 9th
You forgot the most important one — don’t ever use PHP, because it’s garbage. If you really want to scale, try Java.
Brandon September 9th
Great article. And I like the whole “Use a framework / Don’t use a framework” message. Bottom line, use the right tool for the job. It makes no sense to use a framework for a simple contact form, on the other hand, freehand, DIY code on a complex CRM app doesn’t make much sense either.
JR September 9th
Um… These are all very common principles for programming in general. Discussions always come up that PHP is a beginner’s language and I always defend it (because like the first principle says, “Use PHP Only When You Need It”). However, when I see stuff like this (that is usually just common sense for any seasoned programmer), I can’t help but think that everyone that says that is right. “Never, Ever, Trust Your Users”… Seriously…? That is the case not only in programming, but in ALL of IT. If issues like that aren’t common sense to you, you really shouldn’t be working in IT.
James September 9th
I love how the Wordpress guy talks about scalability, when wordpress is digg speak for ‘cannot connect to database’. You should expect lousy performance from a toy dbms like mysql, and a toy web language like php, which is basically all the worst of Perl 1 plus ugly shit bolted on the side.
Muhammad Adri September 9th
Nice 10 principles…..!!! Thanks
Mike T. September 9th
Is this considered part 2 of the PHP training series or is this unrelated?
boozme.com September 9th
super summary….thanks
please continue to be the top 20 or 25
good tips
Christian September 9th
Great read. Thanks.
Adriaan September 10th
Thanks for the post! As a php developer, I found it quite useful.
Ludovic September 10th
excellent, i will do a french translation if you allowed me
Puneet September 10th
Good Read
insic September 10th
@Mike T. im pretty sure its not.
Niyaz September 10th
Thanks for the advices…… Will keep in mind next time.
Roshan Bhattarai September 10th
great article……..thanks for sharing such a wonderful tips
erichansa September 10th
I agree with Rasmus Lerdorf “Don’t use a PHP Framework” dirty dirty things. write once and reuse to save the time a framework is supposed to save you (then steal back cos it’s buggy, no names CAKE!)
Lucianu September 10th
Good tips =) thanks for sharing
Never ever trust your users =))
amolpatil2k September 10th
@James
“I love how the Wordpress guy talks about scalability, when wordpress is digg speak for ‘cannot connect to database’. You should expect lousy performance from a toy dbms like mysql, and a toy web language like php, which is basically all the worst of Perl 1 plus ugly shit bolted on the side.”
Now, now!
Jonathan Kelly September 10th
Killer article. More than the tips, love all the links you included to other great resources. Keep it comin’!
FCY-Pierre September 11th
Great article.
Thx for all of the the given links.
Ben September 11th
Nice article, other that the part about frameworks running slower than vanilla. It’s more of a “most embarrassing quote” nominee.
coolwebdeveloper September 11th
Nice post … I agree using framework for simple tasks might be an overkill … it really depends on the type of work a developer is doing.
freeVBtools September 15th
great articles!..
all that famous paintings make me feel like Im reading another 10 commandment!
Bill Canaday September 15th
“Rasmus still looks at php as a scripting language that should only be used when absolutely necessary. He dislikes MVC based frameworks and believes performance trumps development speed and flexability.”
Performance DOES trump dev speed (can’t see how using a framework gains flexibility). Yes the developers time is money … but so is the users time. Fairly often, the same company is paying for both. An extra week coding to shave a second or two per response is time well spent, IMHO, if the data is going to be accessed at all frequently.
Martin September 16th
nice article and whole page..
im impressed..
david windham September 16th
nice artwork? credits? public domain… what’s the dealio.. I think i’m going on a screen capture hunt at every museum site i can find.
mark September 16th
where is the alt text / title for the images?
nice read and source
cheers
Cesar Noel September 18th
Nice Tip and Advice
evergreenphp September 18th
Hi Glen,
Superb informations… Great Dude..!!
vadivel September 18th
This very nice articles.
Rajassegarin September 18th
The article looks cool.
Jordan Payne September 19th
Great read, thanks!
cyberbuff September 20th
Awesome read, indeed. thanks
Alex Eiswirth September 23rd
Nice one. I like the paintings the most
Juarez P. A. Filho September 23rd
Yeahh… Guys you Rock. A lot of resources to learn how to do better code and Web Apps. Thanks.
hikaye September 23rd
Thanks you very much
Freeware Collection September 28th
Thanks for your greate article.
article September 30th
Thank you Author for such interesting article , little where possible read so much much useful information
Shane October 1st
I think that an overview of PHP frameworks would be welcome on the site. What do other readers think?
Syngenetic October 1st
Not bad a of a list. Quite interesting actually!
Syngenetic, http://www.CoderScripts.com
Velvet Blues October 3rd
Nice list. I especially like #3. Many people neglect to validate and parse user input because of all the extra time that it might take, but can often result in corruption of the database or even a poor user experience. And if a user is malicious…
vahur October 10th
A true list of important things, but “Use a framework / Don’t use a framework” doesnt seem logical together.
Mark A Batchelor October 11th
Your code needs to be clean, organized and make its intent clear … getting it to work is less than half the job.
Isaac Seymour October 12th
THANK YOU!!!
I’ve just downloaded Eclipse PDT - thank god I did!! I’m almost a convert from Dreamweaver now
I haven’t checked out it’s JavaScript/jQuery code formatting, but even if that is good (I’m expecting it will be now!), I’m still going to stick with Dreamweaver, just because of the nice Live View (I’m using CS4 beta), and because of the nice integration with the rest of the Creative Suite. Best thing is - it’s FREE!!!!!!
I really need it to be now that I’ll have to be upgrading to CS4 when it comes out at the end of the month - so that’s gonna kill my budget.
I think I’m going to stick with not using a framework - I think your article shows that it’s a matter of opinion, so I’ll stick to what I know, (”if it ain’t broke, don’t fix it”).
Thanks again for the great article!
mjcpk October 12th
There is not definite truth in the world and certainly not when it comes to programming languages. It’s nice to see a collection of opinions like this that leaves us to make up our minds based on our own requirements. A good example is the framework thing. A blanket ‘Use frameworks!’ or ‘Dont use frameworks!’ doesn’t mean anything. Like it says in #1 we have to make our decisions based on our requirements and not just use a language, framework or programming paradigm just because we can.
@Shane - An overview of frameworks would be an interesting read, thanks.
abrek October 13th
Many thanks for the interesting article. It’s very true and helpful for my. Frameworks definitely help in reducing development time, but I find all frameworks slow for great projects
yAnTar October 21st
Interesting post, although most of these things understandable to all. Especially pleased illustrations
php secrets October 22nd
nice and interesting post… Thanks, Its very helpfull as Im newbie in PHP.
muneefvc October 30th
Great article!
AJ October 30th
No framework? This is a joke…
Ok framework are slower than pure PHP but so what? Adding 1 Gig of ram to your server will cost you what? $100? That’s only 2 hours of salary.
And I can guarantee you that using a framework will save you more than 2 hours.
Also maintaining code written with a framework is MUCH easier than browsing through spaghetti code.
I’m sorry but this is the kind of comments that are hurting PHP’s reputation.
Jon November 17th
Use a framework. If it runs a little bit slower than writing straight scripts, refactor and optimise. Using a framework forces you to write organised code; for large sites you cannot not get away with not using one.
Great article though.
Jon November 17th
Use a framework. If it runs a little bit slower than writing straight scripts, refactor and optimise. Using a framework forces you to write organised code; for large sites you cannot get away with not using one.
Great article though.
Spyrochan November 19th
I beleive in 8. Don’t use a PHP Framework - Rasmus Lerdorf
Add Your Comment
( GET A GRAVATAR )Your Name November 21st
Trackbacks