Hacker News Reader

Comment by mywittyname | Hacker News Reader

I think it would be better to write a plugin for various PHP IDEs that contain fingerprints of bad code which is used to yell at the programmer if they are using these old, insecure code snippets. Heck, you could add a feature or note to the developer to down-vote the source of said code.

It would be a lot of work, but I think it's easier than trying to get authors of defunked blogs to take down 10 year old answers.

As a side-effect, this increases awareness among developers that you can't blindly accept what's on SO. If developers begin to lose trust in SO, then SO is going to be incentivized to do something about, or go the way of expertsexchange.

View on HN

This is called static analysis and it's a very active field of research. The main pain is figuring out which analyses to enable in existing code bases, because if you have a hundred diagnostics from legacy code you don't want to deal with, you're going to miss the one or two new warnings in the code you just added.

For greenfield projects it can be a godsend, if you have the experience to know which warnings you should disable and the discipline to keep the entire code base warning-free. I've done this with StyleCop / FxCop in C#.

Here's a list of PHP static analysis tools: https://github.com/exakat/php-static-analysis-tools

There's a plugin for IntelliJ IDEs called "PHP Inspections (EA Extended)" [0] that detects some of these compatibility and security problems.

[0]: https://plugins.jetbrains.com/plugin/7622-php-inspections-ea...

This could certainly be a starting off point for what I was imagining.

I was thinking that they could do analysis on code snippets that are copy-pasted into the editor. It should be straight-forward to compare the contents to a finger-print database and issue a warning when they find a match to online code examples that are marked as vulnerable.

If you ever type in mysql_query it should archive your project, encrypt it, and hold it for ransom until you apologize and promise to never touch that function ever again.

PDO isn't more secure if someone writes:

  $sql = "SELECT * FROM table WHERE id = " . $_GET["id"];

It's all about education. This does apply to any language.

FWIW, it’s “defunct”. I like the idea of defunked blogs though.

I've been using netbeans recently and it has this very annoying and effective squiggles that warn you when you use deprecated stuff. It also tries to enforce some best practices by default

PHP also has runtime errors for deprecated functions when using strict mode, which everyone should use

Reply on news.ycombinator.com