CodeSOD: JaphpaScript

Let’s say you have a web application, and you need to transfer some data that exists in your backend, server-side, down to the front-end, client-side. If you’re a normal person, you have the client do an HTTP request and return the data in something like a JSON format.

You could certainly do that. Or, you could do what Alicia‘s predecessor did.

<script>
    var i;
    var j;
    var grpID;
    var group_Arr_<?php echo $varNamePrefix;?>= new Array();
    var user_Arr_<?php echo $varNamePrefix;?>= new Array();
    <?php
    $i = 0;
    if(is_array($groupArr)) {
        foreach($groupArr as $groupData) {
            $t_groupID = $groupData[0];
            if(is_array($userArr[$t_groupID] ?? null)) { ?>
                i = '<?php echo $i; ?>';
                grpID = '<?php echo $t_groupID; ?>';
                group_Arr_<?php echo $varNamePrefix;?>[i] = '<?php echo $t_groupID; ?>';
                user_Arr_<?php echo $varNamePrefix;?>[grpID] = new Array();
                <?php for($j = 0,$jMax = count($userArr[$t_groupID]); $j < $jMax; $j++) { ?>
                    j = '<?php echo $j; ?>';
                    user_Arr_<?php echo $varNamePrefix;?>[grpID][j] = '<?php echo $userArr[$t_groupID][$j][0]; ?>';
                    <?php
                }
                $i++;
            }
        }
    }
    ?>
</script>

Here, we have PHP and JavaScript mixed together, like chocolate and peanut butter, except neither is chocolate or peanut butter and neither represents something you’d want to be eating.

Here we have loop unrolling taken to a new, ridiculous extent. The loop is executed in PHP, and “rendered” in JavaScript, outputting a huge pile of array assignments.

Worse than that, even the name of the variable is generated in PHP- group_Arr_<?php echo $varNamePrefix;?>.

This pattern was used everywhere, and sometimes I wouldn’t even call it a pattern- huge blocks of code were copy/pasted with minor modifications.

This pile of spaghetti was, as you can imagine, difficult to understand or modify. But here’s the scary part: it was remarkably bug free. The developer responsible for this had managed to do this everywhere, and it worked. Reliably. Any other developer who tried to change it ended up causing a cascade of failures that meant weeks of debugging to make what felt like should be minor changes, but in the state which ALicia inherited it, everything worked. Somehow.

Source: Read More