PHP and Scalability

Doesn't yahoo run it's sites with PHP... plus you suggest Java and Jave sux

Not Scalable? Ever hear of a little something called Facebook? Java is a terrible excuse for a web development tool, Java is a generally terrible language. The only reason its even still used is its become many college students first language, which is a crying shame in it self. .Net is more efficient than Java for crying out loud and Sun had how many years up on them to improve it? In conclusion, to say PHP isn't scalable is plain ignorant.

Friendster used to be Jsp/Java. Could somebody tell me why they to ported to Php?

Last thing I heard, they hired the best java programmers and authors of java/jsp books they can find to fix the problems associated with java/jsp on Friendster. No improvement. Came Php and everything was solved.

Btw, does the author know about set_time_limit() to control how long a Php process can execute? I have a feeling that the author lacks research or whatever.

I am a PHP developer--among other things and have developed PHP apps for major companies and for the one I work at now. I know about how to increase memory and time limits for PHP scripts and also know that PHP has some serious limitations. I have developed in .NET too but prefer PHP and turned down a job doing .NET development because of my own prejudices. I am no fan of Java either - I have tried to develop in it but I just hate it - but one must admit that it is a true enterprise solution.
PHP is cool and getting cooler but there are many things missing. The PHP developers, prompted by complaints, are basically turning it into Java so that it will scale to the Enterprise.

If you are going to make a statement like PHP isn't Enterprise ready, then you better back it up with some proof, or a good reason why. The other two articles on Perl and JavaScript were a bit better, but this article had no weight behind it at all.

Feel free to disagree with me but I think that your statement on PHP scalability is not fair.

Yahoo, Facebook, Wikipedia, Technorati, Digg, Flickr, Friendster and countless extremely high traffic websites are powered by PHP. PHP may be not really good at long running application but its power on web-based short request-reponse model is proven.

The PHP Scalability Myth: http://www.onjava.com/pub/a/onjava/2003/10/15/php_scalability.html

Digg PHP's Scalability and Performance: http://www.oreillynet.com/onlamp/blog/2006/04/digg_phps_scalability_and_perf.html

PHP Scalability & Performance Facebook: http://www.geeksessions.com/media/1.3/lucas_nealan.pdf

Author does not really understand the "register globals" issue. It's not about "declaring variables before use" it's about automatically registering a plain global variable for every http request parameter passed in regardless of whether it came from a POST, a GET or a COOKIE. And, yes - it's fixed permanently in 6 and has been fixed by default since 5.

Pure FUD, leavened with BS for flavor. This seems to have been written by somebody who's deeply invested his career in Java and is now coming to the realization that Java over the next five years is going to be roughly where RPG II or Lisp have been for the last five; to put it mildly, not an expanding, lucrative market.

I've been developing software professionally for almost 30 years, and doing Web development for over ten. I make it a point to learn two languages a year well enough to be able to pick them up again and do professional-level work on short notice. I know Java quite well, along with Python and perl; I've used each of them on enough different Web and standalone projects that I am confident that I have at least a journeyman-level awareness of their strengths and weaknesses. I have been doing PHP development since well before PHP 4 was real. PHP 5, and especially 5.2, have been my Web development language of choice since their inception. PHP 5 brings a good-enough object and interface model, non-perl-like clarity and obviousness of approach, and an architecture that lends itself readily to easily scalable applications (unlike, say, Rails). Yes, PHP does require you to know what you're doing if you are to do it well, but I happen to think of that as an advantage. It also, somewhat regrettably, allows one to develop absolute spit spaghetti code, but that can in practice be refactored long before it becomes as impenetrable as some of the production perl I've worked with/done battle with, which makes APL as cheerily verbose as COBOL and PL/I in comparison.

PHP shouldn't be the only tool a self-styled professional-level developer (or even a serious amateur) has in his toolbox, but it has earned its success through shipped code that works, rather than geek buzz(perl,Rails) or marketing budgets(Java). That, in and of itself, should recommend it highly.

PHP doesn't scale well. Hmm... ever heard of Wikipedia? They run on the LAMP (Linux, Apache, MySQL, PHP) stack, and their site is quite responsive.

Feature overload can definitely cause slowdowns, however. I recently switched a client's website from PostNuke to a custom lightweight CMS (also written in PHP). The Nuke site was incredibly slow, taking nearly 1500 milliseconds to respond when a link was clicked. The new site was lightning-fast, never taking more than 200 milliseconds to respond. (This includes the 100-150 millisecond latency of my network connection.)

My CMS was about 1500 lines of code, compared to Nuke's 10,000+ lines. Why run code you don't need? It slows you down and increases your attack surface.

Regarding security, PHP is only insecure if used improperly.

Consider these common security "threats":

• register_globals
• SQL injection
• Code injection

Register_globals can be dangerous if you don't initialize your variables properly, but variables are supposed to be initialized anyway. Register_globals is off by default in PHP 5 and will be removed in PHP 6. In fact, the first thing I do when I set up a website is to turn OFF register_globals via a php.ini file.

SQL injection can be largely eliminated by input filtering. Getting a Webmail message ID? It must be an integer. I'll be that nobody here can figure out what value $x should have, such that intval($x) is unsafe to use in a database query!

The chance of code injection can also be largely reduced by careful design. I've been programming in PHP since I was twelve, and I've only written two scripts using the eval() function - and both of them used carefully validated, hard-coded parameters. If your site will execute arbitrary code from the query string, you'd better think VERY carefully - it's almost never necessary.

ColdFusion has a number of advantages over PHP, has a very robust API, and works well with both Java and .NET.