The present and near future in web development

Late reply, but it piqued my interest so I thought I'd post my 2 cents.

I'm still really not a fan of off-the-shelf CMS systems like Joomla etc, because I find them inherently harder to develop additional features for when compared to things I've coded myself.

At work myself and another dev are currently developing our own 'framework' if you will with features that can be added/removed such as CMS, online shopping, time management, restaurant menus etc.

It's literally just PHP and Twig, but the simple nature of it makes it so easy to develop for, and because we did it from the ground up, we know it inside out. I'm a firm believer than home-grown code is best, provided it's written well

 

Indeed, I like to create php from scratch but I must admit that I love Wordpress too. Joomla is cool, but way to messy and heavy to me.

Remember that when creating a cms from scratch the most important part is its security. You don't want people messing with the sites db's easily after all. Be careful when using forms and I'd recommend using MySQLi for stuff.

 

Something akin to CakePHP maybe?

 

Quality developer time is rare and expensive; that's the entire reason why prebuilt CMSs are popular.

For similar reasons, PHP itself is neither the present nor future of web development, it's the past. Rails is the present, and Node.js is the future.

 

Rails lets you do more in less time with less hassle.

Node.js is even more seamless (a web server stub is six lines of code), but it's too young to have as much framework support as Rails, which is why it's the future and not the present. I'm using it for a personal project, but I can't objectively recommend it as The Way.

Honestly, the biggest problem with PHP is that it encourages subpar coders to produce subpar code, in the same way that IE6 taught all the HTML-slingers that they could write bullshit HTML and reload until it looked right, only now the playing field is SQL injections and URL hacking. And since you're talking specifically about future projects of unbounded complexity, I would strongly recommend spending a day apprising yourself of all the options, if nothing else just so you know what's out there.

Rather than pontificate all day, if you're interested, here's an example guide comparing CodeIgniter and Rails directly. It's a couple years old, so you might want to skim it rather than take it as line-for-line gospel. To see the latest state of Rails, try the official getting started guide.

edit: just found a fantastic summary of the state of node.js, its advantages, and what's holding it back (so far), with bonus observations on the ascent of Rails.

 

I'd like to see this point elaborated. Do the other frameworks you mentioned force things like auto-sanitizing form submissions unless specifically told not to? Or they have some more specialized or more automatic protection against injections? Because the things you mentioned, sql injections through forms - either GET or POST - are so basic that I'm honestly surprised that they still work on some sites.

 

Rails is MVC and expects you to use active record model classes. So it has 'specialized protection' as part of its general eschewing of writing straight SQL. (If you choose to write straight SQL, you have to take care of it yourself.)

But what I meant by "PHP encourages subpar coders to produce subpar code" was as much cultural as technical. Just on a lark, I googled 'php sample form code' and got this complete garbage. Google 'rails sample form code' and you get this complete reference.

This is unbelievably important! Someone seeking to learn PHP is being taught worse techniques and becomes a worse programmer than someone learning Rails. This is at the core of why you still see sql injections in PHP in 2012. (And in my personal experience, every business PHP site I've been asked to look at has been ludicrously open to hackery.)

Worth noting that the one time the Rails team made the wrong decision on security, with mass assignment, it turned into a shitstorm and they're being forced to reconsider (heh).

 

Actually, its not that I stay out of it, its just that I prefer other alternatives when it comes to using it. The problem I have with Joomla is that everything is a plugin/module and its way too structured. If you want to create a totally unique site, you're gonna need to edit a tonshit of files right off the bat. Short Story, It works for corporate sites, but for modern, trending, and good designed sites you will need something that gives you more freedom, Wordpress is an example of a CMS that lets you do whatever you want or need to without obstructing your site pages, no need for modules and stuff, only a header, main body and footer to arrange wherever you need to.

Also, on the Rails discussion, Rails is awesome... I believe a really good killer combo would be its usage for data stuff, and Less (Framework) for appearance, but that's when writing stuff from scratch of course...I'm not that used to Ruby though.

 

I think it depends on how much work you want to put into it. For my personal website I use the Invision Power suite, IPB and IP.Content for the CMS. Its parser is really weird and so writing code for it can be really quirky and time consuming compared to just writing something from scratch in a blank PHP file. On the flipside though, there's a lot that I can do a lot faster with IP.Content, and it allows me to easily give my website an integrated unified feel, which is really nice

So overall yeah I'd say that CMS is gaining some share for web development but there's something to be said for writing something cool from scratch

Also Joomla is slow as shit in my experience I'm not a big fan of it

 

Eh, so just because people write idiot guides, the language is suddenly crap? I don't see the problem with the guide you linked to - it only covers forms, not security. It's basic information to get started with, but not something meant to be the backbone of your site. Yes, someone using just that guide would end up creating a honeypot without knowing, but if you blame people for being stupid and ignorant - and others for taking advantage of this - then you might as well blame the entire human race, not PHP.

 

I will freely admit that I am not entirely persuaded by your alternative suggestion of blaming the entire human race for being stupid and ignorant. I think I'll just keep focusing on using the best tools available to build the greatest systems I can with the most driven colleagues I can find. Call me crazy.

 

The problem is that SQL requests are essentially passing a small piece of code to an interpreter, and as you can imagine things like strings and such need to be properly escaped to not mess with the language syntax... and most lazy programmers will completely forget to escape the user input.

 

Well, in a random bit of timeliness, Eevee has put way waaaaaaaaaay more effort into detailing PHP's issues than I ever would. Yikes. If you prefer 100 paragraphs to 100 words, he's got you covered.