My (many) bad habits

matbennett

I'd never really done any programming before stumbling over PHP a few months ago but seem, in my own eyes at least, to be getting on pretty well with it.

The problem is that, like most, I am self-taught and probably picking up bad habits left right and center (It's only people's sig-lines here that have made me look at global v local vars, as one example).

My question is simple: Does anyone know of some good resources (be they online or in print) that covers "best practice" with regards to PHP. I know the basics and a few areas in a bit more detail, but really want to get rid of my bad habits before going too much further.

ta'

jerdo

Just make sure your code is clear and readable by anyone who might have to work with it, including you six months later when it breaks for no known reason and you have to go back and fix it. Other things such as how far to indent what, whether the { on an if goes right after the ) or on the next line, is all subject to who you are talking to or reading. Comments help to make things a little more clear, as does spacing (don't put the whole program on one line).

feldon23

Post some example code.

If you are using POST or GET method in your scripts, you are doing this, right:?

$_POST['name'];

instead of

$name

ednark

there is no such thing as correctly styled code...

if you can read it as your typeing then its ok code
if you can read through your code at a glance after you've finished, the its great code
if you can figure out what you were writing after going back to it months later, then its wonderful code
if my sister can read through you code and understand what its doing, then its perfect code

so my advise is.. be consistant... USE COMMENTS

PUNCHLINE: it doesn't matter what there are as long you have them


#hate this:
$name = 'dan'
$state_code = 'VA';

#like this:
$name       = 'dan'
$state_code = 'VA';

rules i follow for good or ill: most people have rules for these categories

1) Common Variable Names
me:
all lowercase with _ seperating words
$i_am_a_variable = 'blah'

ive seen people specify type also:
$int_integer = 5;
$str_string = 'i am a string';
$arr_array = array( 'im an aray' );
$obj_object = array( 'im an aray' );

2) Common Function Names
me:
first letter lowercase all other words Uppercase, no spaces b/w words

function formatTheText() {}
function getFromDatabase() {}

$i_am_a_username = findUserName();

3) Common Class names
me:
all first letters Caps, no divisions

class MessagePasser

$message_passer = new MessagePasser();

4) Common Scheme for commenting
me:
i write out my comments first for the function in plain english, then fill in with code what i was talking about

so my comments tend to have a consisent style to them than i can follow afterwards

Arc

Originally posted by feldon23
Post some example code.

If you are using POST or GET method in your scripts, you are doing this, right:?

$_POST['name'];

instead of

$name

What is the advantage of using

$_POST['name'];

instead of

$name
?

I Use $Name and my programs work just fine... So what do i gain by typing out this extra text $_POST['name'] ?

Also I Capitalize the first letter of all words.
$MyArray[0] = "ArrayItem1";

I use all Uppercase for any SQL KeyWords such as
"SELECT * FROM tblMyTable WHERE MyField LIKE '$MyVariable' ORDER BY MyField"

matbennett

Thanks all. Interesting stuff so far.

Think that I am following much of the above already, and have been weaning myself off the "it was hard to write, it should be hard to understand" approach to commenting since the first time I went back to make changes (oh, what a joyous weekend that was!).

How well I am following them though, would seem to depend on how good at cryptography ednark's sister is!

If you are using POST or GET method in your scripts, you are doing this, right:?

Just starting to. To be honest I still don't know why I am (educational link welcome), but reading these forums tends to drum it in with you. What annoys me slightly though I have yet to see an introductory tutorial that does not demonstrate the "bad" method.

zalath

$POST["blah"] becomes $blah automatically -- but only if register_globals is on in PHP settings. Hence it's better to use the $POST way, just to make sure. Also, it keeps GET, POST, COOKIE and SESSION variables separate, and helps to keep the code more readable.

orionblue

That's something I've been wondering about - I have heard that the last version(s) of PHP have been promising that $_POST will be a requirement (there will be no option to turn off register_globals) because it is a more secure way of transmitting variables?

I ask because if that is the case I'd better change my evil ways - or free up some time to re-write the last 2 years' worth of sites I've done...

superwormy

I don't think that PHP will drop the option for register_globals anytime soon, but everyone SHOULD stop using it, its must more secure to have it turned off, and it makes things cleaner and easier to understand as well.

feldon23

I ask because if that is the case I'd better change my evil ways - or free up some time to re-write the last 2 years' worth of sites I've done...

As long as you aren't defining lots of functions, you should be able to initialize these variables at the top of your documents.

$name=$POST['name'];
$email=$POST['email'];
$referrer=$POST['referrer'];
$php_self=$SERVER['PHP_SELF'];

etc.

driverdave

What is the advantage of using

$_POST['name'];

instead of

$name
?

I Use $Name and my programs work just fine... So what do i gain by typing out this extra text $_POST['name'] ?

Because in 6 months, when you go to edit your code, you'll have no idea where $name is coming from, but you'll know that $_POST["name"] comes from posted data.

Thats what the variable is. It's the POSTed variable name. Global variable soup was a huge mistake in earlier versions of PHP.

Arc

Originally posted by superwormy
I don't think that PHP will drop the option for register_globals anytime soon, but everyone SHOULD stop using it, its must more secure to have it turned off, and it makes things cleaner and easier to understand as well.

How is it so much more secure? And how do you figure it makes it more clear and cleaner? It just makes the code Longer to type out and look all cludered up to me.

matt_4013

It's more secure, because if you're using global variables, it's very easy to spoof the value. For example, you have a script that checks to see if a form has been submitted:

if(isset($submit)) {

// Process your form data

} else {

// Display the form

}

Looks alright?

What happens if someone goes to http://yourserver.com/script.php?submit=foo ??

Suddenly, because you're using global variables, submit is set, without the form being posted! Ack! By using $_POST['submit'] or $HTTP_POST_VARS['submit'] you can avoid this.

Just a small example of how global variables can cause you a lot of trouble. Always remember, people are assholes, and there are a lot of them who will do anything in their power to break your server/code/data.

Hope that helps,
Matt

feldon23

Just passing thru. 🙂
See the sig.