Maintenance Patterns of large-scale PHP Web Applications Panos Kyriakakis1 and Alexander Chatzigeorgiou2 1 Hellenic Open University 2 University of Macedonia, Greece ICSME’2014, Research Track, October 3, 2014

Ewww, You Use PHP? As we said in our teaser video, there are various sources in the Internet, mainly anecdotal, that claim that Scripting languages are not appropriate for proper software engineering Not appropriate for building large projects that should be maintained Not appropriate for teaching CS1 but you can hardly find any research evidence on which these claims are based Most of the features offered by scripting languages are not offered by Java

Stanford : Javascript (variant) Berkeley: Python Systematic argumentation on the benefits of scripting languages has been developed CS101 in: MIT : Python Stanford : Javascript (variant) Berkeley: Python Harvard: C, PHP, Javascript Cornell: Python

Five large open-source PHP Web Applications Goal of this work Study the evolution of Five large open-source PHP Web Applications In terms of quality, maturity and migration to OO

Case Study Design 2,674 themes, 110 million downloads 492 contributors for Drupal 5.0 most widely used open source bulletin board system PhpBB is by far the most widely used open source bulletin board system Started in 2000, 1.8 M downloads in sourceforge, translated in 50 languages, ~ 2577 downloads / week “born” in 1998. > 200,000 downloads / month 669 contributors, estimated effort: 136 person-years

Analyzed Projects Project Years Releases First Last Release KLOC Code Blocks WordPress 9 71 1.5 20 763 3.6.1 200 5154 Drupal 12 120 4.0.0 14 692 7.23 173 5140 phpBB 37 2.0.0 18 256 3.0.12 194 2389 MantisBt 8 33 1.0.0 68 2447 1.2.15 165 4904 phpMyAdmin 129 2.9.0 39 693 4.1.6 248 5343 Some of the projects have their roots back before PHP fully supported object-orientation, providing the opportunity to investigate the migration. 390 official releases Lehman's 6th law confirmed 50 years of evolution >36 million LOC

The Approach Downloading Bergmann’s PHP DCD AST analysis

Survival Analysis Survival analysis models the time it takes for events to occur why do we need survival analysis? Start of the study End of the study censored ??????? censored Survival analysis models the time it takes for events to occur and focuses on the distribution of the survival times Let us assume that we observe patients over time and monitor the time it takes for an event to occur (unfortunately, this is usually death) ??????? censored time

Kaplan-Meier curves C(ti)=S(ti)*C(ti-1) Survival function S(ti)=1-di/ri Cumulative Probability of surviving up to time t C(ti)=S(ti)*C(ti-1) If this was a real treatment then you would conclude that treatment for Group1 is more successful

Survival Analysis: function usage in PHP Termination event: a function becomes unused

function usage in PHP (2) Survival Analysis  Way of identifying hotspots Stalactites= hotspots or POI

function usage in PHP (3) Survival function S(ti)=1-di/ri method Additions (%) nuSoap library ADOdb library For three of the projects a common pattern can be observed. Drops in the survival function appear when employment of libraries takes place. In scripting languages like PHP, using a third party library, implemented also in PHP, means that the library's code has to be added to the application's code. Unavoidably, using a proportion of the library's functionality leads the rest of the library code to remain unused. However there is also another reason for which we see methods that are not being used and that is the hooking mechanism

Hooks Stealth calls /* global array of registered hooks */ $hooks = array(); /* function for registering hooks */ function add_action($hook, $funcName) { global $hooks; if( !isset($hooks[$hook]) ) { $hooks[$hook] = array(); } $hooks[$hook][] = $funcName; /* function for executing a particular hook */ function do_action($hook) { foreach($hooks[$hook] as $fn) { call_user_func($fn); /* extensible function */ function myFunc() { /* ... function code ... */ do_action('my_hook'); /* extension */ function myHookFunc() { } Stealth calls A simplified example on the widely used practice of hook functions. Hooks offer a functional implementation of the observer pattern /* registering a hook function */ add_hook('my_hook','myHookFunc');

function usage in PHP (3) Stalactive – Stalagmite phenomenon In general drops in the survival function coincide with major versions. A stalactite-stalagmite phenomenon is evident: new code is added in major versions, where the introduction of unused code is taking place as well (which can be either due to the introduction of libraries or the use of hooks, both of which imply major architectural changes)

Survival Analysis: function removal Termination event: a function is removed from the system

45% replaced with methods function removal in PHP (2) Survival function S(t) Percentage of added methods 45% replaced with methods 62% of removed functions replaced with methods It is important to mention that whenever functions are replaced with methods, it is entire pieces of functionality that migrate to classes

function removal in PHP (3) However, not all systems convert existing functions to methods Functions are replaced with functions Only new functionality written in OO In contrast Drupal and Wordpress do not convert existing functions to methods. They only implement new functionality with OO. The reason is that in these systems there are thousands of plugins (more than 30,000 in Wordpress) and reimplementation of existing functionality with methods would lead to compatibility problems. So, the designers of these systems are extremely cautious Why ? Wordpress: > 30,000 plugins, > 2,000 themes Drupal: > 8,000 plugins, >600 themes

Library usage “pre-made building blocks ease and speed up the development of applications” (Tulach, Practical API Design) “external libraries and their usage have a significant impact on the maintenance of the including software” (Bauer et al., ICSM’2012) In PHP library code becomes part of the system’s source code  Easy to measure There are various findings regarding the importance of libraries in software development like Tulach who concludes that…  

Library usage (2) added PHPExcel Some of the systems like phpBB and Drupal employ a limited portion of third party libraries Drupal gradually replaced third party libraries with in-house code trying to build its own ecosystem and delivering all components under a single license All other systems are gradually introducing library code at a steady pace. PhpMyAdmin is quite interesting where for a time period library code was equal to system code. So we see major architectural decisions such as the choice to rely on a particular library or not

Interface Stability Category Impact Severity Freq. C1 Change   Category Impact Severity C1 Change of mandatory parameters Breaking function's compatibility Freq. 0.09% 0.15% 0.02% 0.94% 0.66% C2 Addition of optional parameters No impact C3 Removal of optional parameters Possible breaking of function's compatibility C4 Change of default values Possible breaking of function's compatibility C5 Change of function's return type Possible breaking of function's compatibility C6 Change of function's implementation No impact 7.46%

Migration to OO   Almost OO Turn to OOP Various trends here,

Evolution of Complexity [0,5) Evolution of Complexity [5,10) percentage of functions with CCN in three ranges >10

Overview of Findings × ✔ Main source of unused code is library usage. Phenomenon Conclusion Survival regarding function usage  Main source of unused code is library usage. × ✔   Unused code appears in major versions Survival regarding function removal Function removal appears in major versions Only new features are implemented with OO Functional code replaced with OO code Library usage Projects reuse code from third party libraries Interface stability Interface remains stable Migration to OO Projects migrate to OO Evolution of Complexity Complexity remains stable

Future Work Embed in our platform SEAgle which currently analyzes Java projects Compare the evolution of large and less known PHP projects

Conclusion Large PHP projects undergo systematic maintenance PHP does not seem to hinder it scripting languages can support the maintenance of evolving software projects and that maintainability is rather an issue of appropriate software engineering practices rather than an issue of the selected programming language.

Thank you for your attention!! (and have a safe trip back home) ICSME’2014, Research Track, October 3, 2014