Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

A dozen of bad tutorials out there that teach you bad habits especially when we speak about PHP. I want to learn how to avoid the things that can lead me to develop inefficient web applications. I like to learn from videos but most videos I've found on the internet are provided by people who do not follow good practices. My second option is to learn from books but I did not find a good book for starters in PHP!

It would be very helpful for me if you can tell me about your story in learning PHP, what are things that I should avoid? How to learn about PHP security from the beginning to avoid unlearn something later on?. Please provide links to books, websites that provide high quality video tutorials for PHP, and you tips for a good start!

share|improve this question
1  
Just used the search facility of stackexchange: Recommendations – faif Mar 26 '11 at 13:21
Do you know Java or any pure object oriented languages? You don't sound like a novice. – Mr. Zen Apr 4 '11 at 4:40
I have been programming PHP for about 6 years now. A year or two ago I reviewed Lynda.com's "PHP with MySQL Essential Training" and "PHP with MySQL Beyond the Basics" and the instructor provides a good PHP foundation and you end up with two pretty good vanilla php apps that you can further customize for your own projects. – Jason Holland Jun 5 '12 at 21:00

closed as not constructive by Yannis Rizos, ChrisF Jan 15 '12 at 12:27

As it currently stands, this question is not a good fit for our Q&A; format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

10 Answers

PHP is probably the easiest to learn mainstream language available right now. This comes with a price though; poor design and vulnerabilities are to be found on a huge amount of php projects, just because PHP allows you to do so, and because many of the people who are using the language are not (or should not call them selves) professional programmers.

A few of the most important things:

Make sure you have error_reporting to at least E_NOTICE during development, or even better to the suggested E_STRICT (for PHP5 and above). PHP is very good in warning you about possible bugs of vulnerabilities in your code.

Be careful though: as nice and helpful as it may be to use error reporting during development, make sure NO errors are displayed on the actuall application while live; it can give the person who is currently using it allot of info about your vulnerabilities! So, on the live project, make sure error_reporting is disabled.

Exception handling is a powerful technique to protect your program flow and get running errors.

If I would start programming now, I would definitely begin with OOP. After 10 years of programming experience, I am convinced that even the smallest project can benefit hugely by taking the OOP approach, for various reasons. Cleaner code, better control over your project, and very important, better scaling.

I have been confronted with this problem many times in my early days when I was still not using OOP: you start with a small project, and before you know it you want to add so many features that you get lost in the end dealing with hundrets of scattered functions and files.

Don't be discouraged by the longer time OOP may take you to think about your code before you start; you will do things in a fraction of the time it would otherwise take later. If you need more info about OOP advantages, here is a relevant StackOverflow discussion.

Set register globals OFF!

Make sure you protect your sql reads/writes against malicious input (sql injection). You will find noumerous articles on how to protect your self against this. For me, among other things the mysql_real_escape_string is a must!

Also you should be aware of SQL Injection.

Books

My first book was "Beginning PHP5, Apache, and MySQL Web Development (Programmer to Programmer)" for the PHP4 verion. I was a beginner then, and I found it excellent. I assume the php5 version should be as good.

If you are already familiar with programming maybe you should get this one. PHP5 Power Programming is also decent.

Those two combined should bring you in track.


Have you ever fallen into the equality operator trap, where you want to check if 2 values are equal but end up assigning a value to the variable? for example:

if ($var = 'something') { //code to execute }

This code will execute, ASSIGNING the value of something to $var instead of checking for equality. Instead, reverse the order:

if ('something' == $var) { code to execute }

if ('something' = $var) returns an error, and since $var could be anything from a simple trivial number to a session determining access levels, I highly recommend this approach.

share|improve this answer
6  
mysql_real_escape_string? not good idea, don't go that way. Use prepared statements. Or even better ORM. – vartec Mar 26 '11 at 20:35
4  
Prepared statements are also a good approach (it's better actually) to make queries secure, but that does not make mysql_real_escape_string useless or a bad idea, in my experience atleast. – mspir Mar 27 '11 at 0:39
4  
When you use prepared statements correctly, it makes functions like mysql_real_escape_string totally unnecessary. That function was created specifically because early versions of the MySQL functions in PHP did not support bound variables, so that hack was developed and employed to mitigate SQL injection vulnerabilities. The more modern mysqli_* family of functions and the PDO library make all of that obsolete. – greyfade Mar 28 '11 at 18:20
1  
A little late - I'd also like to note that charsets changed during the connection do not change the rules by which mysql_real_escape_string escapes, creating (for some charsets) a injection vulnerability even if you DO use it to escape. – Erik May 13 '11 at 21:43
There is a newer version of Professional PHP 5 Programmer... It is called... Professional PHP 6 Programmer. PHP 5.3 would be more suitable for the title, but I suppose that's marketing :P I've got it and I strongly recommend it. – Carlos Campderrós Jun 28 '11 at 12:47

The Nettuts blog contains many excellent articles on PHP, check this one:
http://net.tutsplus.com/tutorials/php/30-php-best-practices-for-beginners/

Personally I would recommend you to use a PHP framework only if you like it, and not because people says it's the best practise.

About security: use prepared statements (and filter_var before if you wish to validate data coming from outside (like email or URL) ).

Read all the PHP articles on that blog and explore the PHP Api, there are so many useful functions. It will be quite enough.

share|improve this answer
Quite a good link – mspir Mar 26 '11 at 13:19

I learned php using PHP By Example. This was a fabulous book and I would still highly recommend it. However the was written for PHP4 so you will need to completely ignore the section on classes and objects as PHP5 completely redid the model for OOP. That being said the rest of the content still applies and is very easy to follow. After that just make friends with the documentation on php.net. I think Spiros made some very good comments and suggestions.

Please Note Learning PHP well will not be an over night experience. And unfortunately you will have to make mistakes before you know how to program securely. Its just a part of the process. You can do your best to learn good habits and techniques from the start but some things you just don't learn without personal experience.

share|improve this answer

I think it would be help to learn PHP by directly using a good framework. That ensures (or increases the possibility) that you do not fall into that script hacking hole.

My recommendations:

share|improve this answer
+1. A framework will teach you good PHP without having to flat out ignore what many sites say to do and avoid the common pitfalls. – Wayne M Aug 24 '11 at 13:52

I'd suggest learning the language while learning a framework. There are many good frameworks and many popular frameworks. Some of these are great bonus points when looking for a job.

Learning CakePHP I believe is a great way to get started, especially if you'd like to learn Ruby on Rails and haven't gotten into MVC yet. "Framework-like" CMS such as WordPress or Drupal are actually a bit better than I originally gave them credit for and they're in fairly high demand.

These are great because you're learning PHP while getting a great deal of work done. Having good database abstractions and a clear way to handle content reduces the chance of being held back by things you have yet to learn about PHP and enables you to explore greater complexity as you go.

share|improve this answer

Have what it takes?

If you have already done the books and if you really have the energy for it, this is what I did. Download the Joomla framework and start studying their code. How they have designed the framework. How their code works. Yes I mean sit down and read their code.

All books out there will teach you error handling, database access and all that. But non will show you how to fit all that into a neat and clean architecture, how it should fall together into an application.

Also the folks who wrote Joomla are experts. They have done a really cool job with the framework. So many times you learn a lot of advanced techniques , notations, functions that are very important but cannot be covered in books due to their depth.

Believe me I just opened and read like two or max three of their classes in their framework and learnt(British English) quiet a bit.

Another positive point is if that you read their code and understand their code you will have a ready set of professionally done library of classes for your use whenever you want.

share|improve this answer
Is self-censorship considered a virtue nowadays? – ThomasX Dec 13 '11 at 9:53
well helping others has always been a virtue, might as well sensor it yourself and save someone the hassle – Imran Omar Bukhsh Dec 13 '11 at 10:37

I learned the basics of php from PHP 6 and MySQL 5 for Dynamic Web Sites: Visual QuickPro Guide by Larry Ullman...Great conceptualization with lots of real life examples.

share|improve this answer
How is there a book on PHP6 when PHP 6 is not out yet/ – Zachary K Mar 27 '11 at 13:56
why i do not know but...you can find it at amazon... – Radheshyam Nayak Mar 27 '11 at 15:52
There were a number of books released in anticipation of the release of PHP 6. However, the PHP 6 planned release was semi-scrapped, with a good chunk of the changes being incorporated into PHP 5.3. – Beofett Mar 30 '11 at 15:26

You can learn the basics of the programming from any of the online web tutorials. However, after that I recommend that you start to use the CodeIgniter framework. Its a great framework which will naturally install good habits in you, such as using a Model-View-Controller format, keeping configuration files and html/view files seperate from the code, etc.

Apart from that, I recommend reading good books on software development such as 'Code Complete'.

share|improve this answer

My favorite book is PHP 5 Objects, Patterns, and Practice, from Apress. It does a good job of teaching OOP in PHP, with nary a mysql or mysqli function to be seen. Also, the author covers design patterns and why they're important. It does require some previous programming knowledge to grasp some of the concepts, but all-in-all its my top recommendation.

share|improve this answer

I think you should start here w3schools PHP, it is a link to a free online tutorial about php.

share|improve this answer
4  
W3Schools is a horrible resource. Read w3fools.com for more specific information/problems. Please don't recommend this site to anyone. – Matthew Scharley Mar 29 '11 at 0:24
@Matthew Scharley: thanks for the link to w3fools.com. I used w3schools heavily as reference for any web development and after I've visited the w3fools site, I've learned to be careful on what I've read on w3schools. – OnesimusUnbound May 27 '11 at 5:07
Yup kill w3schools.com See their page on php/mysql insert with SQL Injections – Carlos Campderrós Jun 28 '11 at 12:54

protected by Community Sep 27 '11 at 5:14

This question is protected to prevent "thanks!", "me too!", or spam answers by new users. To answer it, you must have earned at least 10 reputation on this site.

Not the answer you're looking for? Browse other questions tagged or ask your own question.