The folks over at Kinsta.com have put together some end of the year usage statistics for PHP across the web trying to answer the "is PHP dead?" question.

You’ve probably heard about how the new WordPress Gutenberg editor brings block-based editing to WordPress.

There is a change going on behind the scenes that casual users might not notice, that Gutenberg blocks are made using JavaScript (React, JSX, and ES6), not PHP. That change, along with other shifts in web development, might have you wondering, “is PHP dead?”.

People have been calling for the death of PHP for years now (you can find “Is PHP Dead?” posts as far back as 2011). And yet, PHP still persists… In this post, we’ll dig into the data and show how PHP isn’t close to being dead (even if you really wish it were).

The article talks about how, despite PHP not being the "most modern programming language", it's still in use by almost 80% of the websites on the internet (8 out of 10 sites). While the number is declining slightly, it's still large chunk of the web based on the reporting from the X-Powered-By header. They also point out that PHP is faster and better than ever with new, impressive features being added constantly and new versions being regularly released.

They also note that it's easy to find PHP developers (with actual experience) and, while you don't have to like PHP, it's definitely far from being dead.

In a new post to their blog, Exakat looks at the use of eval in PHP applications and how, despite all of the warnings against using it, it's still found in quite a few codebases (based on their scans).

It is 2018, and we can still find eval() being used in more than 28% of every PHP code source. It is repeatedly reported as a security issue and a performance bottleneck, and a memory hazard. Yet, we can’t get rid of it.

It seems reasonable to think that most of eval capabilities are available as a PHP features. So, we took examples from 2000 PHP open source projects, and reviewed the situation. Here are real-life examples of eval usage : for each of them, we’ll discuss the actual replacement.

Their examples include the use of eval for:

• JSON decode replacement
• Creating missing classes
• Rewriting classes on the fly
• Code compatibility
• Dynamic variabling

...and several more. Each comes with a summary of the method and code showing how it's being used. While some of the suggested replacements are built-in features of the language, others are recommended packages that can provide the same or similar functionality to what the original author was trying to accomplish.

Terry Chay has an interesting post on his site that wonders which language has better packages - PHP or Python?

It depends on the target utility. In the Python world, the most common package installer is pip; the PHP world didn’t settle on a dominant format/installation for packages until composer, and that was relatively recently (last 4 years).

[...] So which has better packages? The answer is it depends on the domain. In nearly any language you can find an adequate package for any of your needs, but overall you will find the packages are higher quality, more up-to-date, and sometimes just better overall in the domain the language seems to target well.

He starts off by talking some about PHP and Python's origins - PHP as a web-focused language and Python as more general purpose - and how this influenced their package implementations. He then shares his opinions on which kind of packages are a more natural fit for which languages:

• for data science/AI/ML applications, Python
• for DevOps, relying on other tools (Puppet/Chef/Ansible/etc) is better
• For server-side web-based packages, I feel PHP and Composer [are the solution]

He also includes some thoughts about other languages - Ruby, Javascript, Go - and their own package managers.

Tomas Votruba has a new post to his site sharing what he calls a "hidden gem" of a PHP package that he finds useful: the NetteUtils package. This is the first part of a series of posts dedicated to packages he finds helpful.

In this series, I will show you not-so-known PHP packages, that I happily use in my daily workflow. They're hard to describe in few words for their various features, but awesome and simple to use.

Today we start with NetteUtils package.

He starts with a few points about why he uses the library (including mentioning some specific functionality) and how to get it installed in your own application. He then goes through some example code showing the functionality he uses including the Strings and FileSystem classes.

On the Exakat blog they have a new post with the results from their evaluation of a wide range of PHP applications showing the Top 100 PHP functions in use.

Here is the top 100 PHP functions : it is the list of the most often used PHP native functions.

The functions are named, and ranked from 1 to 100. The other 4500 functions are not ranked now. The frequency column represents how often this function is used across PHP code : the reference corpus is a list of 1900 PHP open source projects. They were audited with Exakat static analysis engine, version 1.2.5. The average is the number of time a function is called within one project. Some function are used in isolation, and others are a staple.

The top 5 on the list are:

• count
• is_array
• substr
• in_array
• explode

Each item on the list comes with "frequency" and "average" scores (that mostly relate directly). Check out the post for the full list and a list of some insights they worked up as they generated the listing.

On the Exakat blog there's a post that covers assertions in PHP, a built-in tool the language provides to help perform simple value based evaluation against certain criteria.

PHP has a clever native debugging tool : the PHP assertions. In a nutshell, assertions are a function call to assert(), that triggers an error when a condition is not satisfied.

[...] Unlike debugging conditions, the assert() syntax has to be read in a positive way. When the condition, aka as the first argument, is satisfied, all is fine, and process goes on; when the condition is not satisfied, then an error is triggered: the message of the error is the second argument.

The post then gets into more detail about the assertions, noting that the result has to be positive and that they can be somewhat configured (basically turned on/off and the error level can be adjusted). It also covers some examples of things to test with assertions, how they should be treated as debugging and to avoid using them on resources outside the code (like database connections).

Jordi Boggiano is back with the latest round of his PHP version statistics as gathered from the information provided by the Composer package management tool for PHP.

It's stats o'clock! See 2014, 2015, 2016.1, 2016.2 and 2017.1 for previous similar posts.

A quick note on methodology, because all these stats are imperfect as they just sample some subset of the PHP user base. I look in the packagist.org logs of the last month for Composer installs done by someone. Composer sends the PHP version it is running with in its User-Agent header, so I can use that to see which PHP versions people are using Composer with.

He then shares the results of the statistics including the total number of users for each version of the language and the difference in just the last 6-7 months. PHP 7.1 has pulled out as a front-runner with PHP 7.0 coming in closely after. He also shows some historical data showing the decline of the 5.x versions and the rise of 7.x versions over the past years. The post ends with information about the percentage of requirements in packages with 5.6 taking the lead but not by much.

On the Zend Framework blog today there's a new post from Enrico Zimuel showing you how you can use Argon2 password hashing in PHP applications (coming natively in PHP 7.2).

PHP 7.2 will be released later this year (2017). This version contains some interesting additions, including two new security features: support of the libsodium library.

With these new features, PHP is the first programming language to adopt modern cryptography in its standard library.

In this article, we demonstrate the usage of the Argon2 password hash algorithm.

He then walks you through the installation of the pre-release version of PHP 7.2 and the argon2 library to get the environment up and running. He briefly talks about what the Argon2 hashing algorithm is and how to use it directly in PHP via the password_hash function. He also mentions the password_get_info function and shows what the result of inspection on an Argon2 application contains.

On the Amazon Web Services blog there's a new post showing you how to use the Monolog logging library and a custom AWS extension to ship your logs to Amazon CloudWatch quickly and easily.

Logging and information debugging can be approached from a multitude of different angles. Whether you use an application framework or coding from scratch it’s always comforting to have familiar components and tools across different projects. In our examples today, I am going to enable Amazon CloudWatch Logs logging with a PHP application. To accomplish this, I wanted to use an existing solution that is both already popular and well used, and that is standards compliant. For these reasons, we are going to use the open source log library, PHP Monolog (https://github.com/Seldaek/monolog).

They start by introducing the Monolog library for those not familiar with it and how it relates to the PSR-3 standard. The ultimate goal with their implementation is to allow for the logs to be shipped to CloudWatch and implement some alerting around them. The tutorial then kicks in and they show you how to use Composer to install Monolog and an add-on to interface with CloudWatch. Code is provided to set up the initial logger and how to have it to log messages to different places. They then move over to CloudWatch and define a filter for the JSON data to find successful logins to your application. They also show how to use this same functionality in a Laravel application, contained in a test route.

On his site today Sameer Borate shares a tutorial showing you how to access Google Insights data via your PHP application with the help of the dsentker/phpinsights package.

Google Page Insights is a required tool to have when analyzing the speed and usability of your site. As you may know these metrics influence how google ranks your page in search results. If you frequently make changes to your web site designs than it becomes mandatory to check the metrics after each change to make sure that the design changes has not affected the score in any negative way. If you have many pages to test than manual testing can quickly become cumbersome.

Thankfully there are libraries that you can use to automate this process. Once such is given in this post which allows you to get Google Page Insight metrics using PHP.

He then walks you through the installation of the package (via Composer) and how to use it, along with your Google API key, to fetch the information for a given URL. You can get information for different environments (desktop vs mobile) and even a screenshot of the page that's under test. He ends the post with a helpful hint for those that might get a certificate error when making the request and how to fix it.