Michelangelo van Dam has a new post to his site sharing some of his ideas about the importance of documentation and how it relates to the overall security posture of a project.

In my previous post I described 10 steps we should take to improve security of web applications. In this article I'm going to describe the purpose of documenting a project and what information should be included.

He starts off with some thoughts about the purpose of documentation, how it can't ever really be considered complete, and the importance of its structure. He offers a few suggestions about effective documentation structure and how it can be formatted to make it easier to grow over time without getting too unwieldy. He then comes back around to the security aspect of project documentation. This includes information about the servers the system is running on, the services that are running and details about which secrets are used (but not the secrets themselves!).

He finishes up the post covering various technologies that can be used to help automate your project and make sure that it is well structured and easy to keep in sync with your documentation.

On thePHP.cc site there's a post that talks about an upcoming PHP release, PHP 7.2, and why it's important despite it not having any amazing new features or too much in the way of major changes. There are a few things they mention, however, that make it seem a lot less boring.

A while ago, Sebastian said in a presentation that "PHP 7.2 will be a boring release". What he meant by that is that PHP 7.2 does not have an awful lot of fancy new features. Okay, adding the sodium extension to PHP's standard distribution is great, but the majority of PHP developers do not have to deal with cryptography in PHP on a daily basis.

[...] We are not so sure anymore that PHP 7.2 really is a boring release. As with every release in the 7 series, PHP keeps getting faster and faster. [...] The PHP core developers, again, did a great job cleaning up some more sins of the past. [...] Along with the cleanups that were already done, quite a few things have been deprecated in PHP 7.2, which schedules them for removal in PHP 8.

They talk about some of the changes coming with PHP 7.2 including the addition of libsodium support, smaller changes to variable handling and what's being done to prepare the language for the next major version, PHP 8. They also remind their readers that no version of PHP 5 - even 5.6 - is supported any longer (just security fixes now) and all current users of the language should upgrade to PHP 7.0+ immediately.

In his latest post Wojciech Sznapka reminds us that type hinting is important in your PHP applications and can help provide more structure and better overall code practices.

One of my favorite PHP interview questions, is: what is Type Hinting and why it’s important? Putting definition in one sentence, Type Hinting is a way to define type of parameter in function signature and it’s a sine qua non to leverage polymorphism. [...] So given the fact, that Type Hinting is optional and we don’t need to specify types of parameters passed to the method – why bother? Answer is easy: well prepared method signatures defines your model and are part of the “contract” that your code reveals to its consumers. It also prevents many silly errors and keeps codebase clean and coherent.

He talks about the best practices on using type hinting including where to put them (in an interface or base class or child class?) and some of the pros and cons of each. He also points out that some practices around type hinting, like overriding the hint and calling the method with unexpected/variable input, should be avoided (see the L in SOLID).

In his latest post Brandon Savage follows up his previous post (about learning the language first) that points out that frameworks are important/useful but they shouldn't be the focus.

In writing about how the framework you learn doesn’t matter, I hoped to advance a position that articulated the fact that among the many frameworks, picking the right one is less important than getting a solid grasp on the underlying language. In fact, frameworks have tremendous advantages to them. They take care of a great deal of things for us, things that most applications need and nobody wants to write every time they need it. Frameworks are tremendously helpful.

He points out that learning a framework first and depending on it for common functions limits your skills and hinders you from the power of the language (PHP) itself. He suggests that it's not a "language or framework" debate, but more of a "language then framework" perspective.

The SitePoint PHP blog has a new post in the "Becoming a PHP Professional" series today from Bruno Skvorc. In this latest post he talks about the importance of other people in the process, including both learning (being mentored) and teaching (mentor).

When you work on improving your skills on your own, you'll often find yourself stuck. In fact, the experts frequently find themselves stuck more often than newbies, but it's the speed and skill with which they "unstick" themselves that makes them stand out in the cold, snowy field of identically unimpressive snowflakes.

He talks about having an "invisible friend" or another non-developer to talk to that may provide a different perspective (see rubber ducking). He covers teams and both the good and bad of being a part of them. He also looks at the mentoring/being mentored relationship and some places you can go to get more information about both in the PHP community. Finally, he looks at a tricky topic - ego in development and the inflation that can happen as your skill level grows.

Others around you – either digitally or in real life – can protect you from both inflation and deflation – a good mentor or colleague will tell you when you're steering wrong, and they'll motivate you when you're in a slump. They'll help you avoid the multi-month cooldown periods and the post-burnout lack of interest that eventually occurs.

Sameer Borate has posted some of his thoughts about logging in PHP applications and how it can be one of the most important things you do.

Software development is an exercise in managing complexity, and the more tools and methods we have at our disposal the easier it gets. One of my favorites is logging - recording important code execution points that I think are important, especially during debugging. [...] But what information does one log and what does one keep out. This usually depends on what kind of application you are developing.

He gives an example of logging on database intensive applications - storing the query execution state - complete with a simple example of an "addUser" method that logs any issues caused by the query execution. If you're not using a framework that has it's own logger, he recommends a few: KLogger, Log4PHP and the Zend_Log component of the Zend Framework (can be used separately)