Some time ago I've posted on french site support about the coming beta of php6 and the end of "magic trick era" because PHP6 suppress Magic Quotes, Register Globals but support unicode among other changes, alike static bindig and namespaces, both O.O.
With all this in mind, PHP aims to be less permissive and educate developers about the way to code PHP with objects, design patterns and security.
But maybe some think there's nothing to learn from past mistakes and maybe some others think that code review is a painful experience for everyone and should still looking forward. But when you get everything together, alike Mr. Minahito has done with XC Legacy code, most XOOPS 'developers' may find themselves unskilled.
Why audit XOOPS code?Most of you are able to quote code from the 10 most used modules and show the code style of different developers (i.e. code badly integrated).
And people wonder why XOOPS and modules code are always full of security holes!?
As i've posted on Gijoe forums, referring to lazy developers that, since PHP is easy to learn, everyone can easily write bad php code for XOOPS (alike any other project/language). Most of the times non-professional pick up some code and start "cloning/forking" to create their own module, framework, library, etc. It's a way to learn. Right, but it also contributes to the perception that XOOPS PHP code is crap.
Some developers have done a badly patchwork, some even call it
spaghetti PHP. While some Italian mamas may feel offended, it still working just fine for their kids under PHP4. Non-professional programmers will not care that the code is crap.
Why to reinvent the wheel?As someone said sometime ago: They learn bad habits and then publish their code and teach others bad habits. I mean here, old hack nuke school
That may explain why some of the most popular open source PHP applications ever are really poorly coded and many nuke based cms have decide to re-code ... Drupal and Joomla come to mind.
But who can force developers to do so? It's open source. Looking at the amount of code released by programmers and third party developers, maybe... lazy... sounds not fair, but it's a reality in XOOPS world. Which needs a skilled programmer or professional developers to reduce the gap with Legacy as Minahito has done with
XOOPS Cube or Gijoe with altsys and D3 modules.
Have Fun !
Ref.
Walk the Walk before Talking the Talk"You must be disciplined enough to...
The other key ingredient of a professional developer?
Humility."
Effective Code Reviews Without the PainBy Robert Bogue