Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

Please, explain why and list which languages have the (mis)feature implemented As far you know.

Post what you consider a harmful feature, not what you dislike.

share

locked by ChrisF Jun 5 '13 at 19:30

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as not constructive by Thomas Owens Mar 12 '13 at 21:00

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Goto considered harmful. –  sbi Sep 13 '10 at 18:55
2  
@sbi You can also read in the same page "XMLHttpRequest Considered Harmful" ... –  HoLyVieR Sep 14 '10 at 12:00
1  
All of them are considered harmful, by somebody or other, with the possible exception of basic expressions. –  David Thornley Oct 12 '10 at 17:51
4  
3  
@David Thornley: a = 1/0 - basic expression, harmful. ;-) –  Orbling Nov 27 '10 at 1:01
comments disabled on deleted / locked posts

30 Answers 30

Register Globals in PHP

Information : http://php.net/manual/en/security.globals.php

This is by far the worst feature to be ever implemented for readability reasons and security reasons. Basicly all the GET parameter received are transformed into variables.

For example with this URL : /index.php?value=foobar

You can do the following :

<?php
echo $value; // return foobar
?>

When you are reading code, it is very confusing to know where the variable comes from.

Also if the feature is misused, it can lead to security hole. Here's a code example from php.net that shows how it can be misused :

<?php
// define $authorized = true only if user is authenticated
if (authenticated_user()) {
    $authorized = true;
}

// Because we didn't first initialize $authorized as false, this might be
// defined through register_globals, like from GET auth.php?authorized=1
// So, anyone can be seen as authenticated!
if ($authorized) {
    include "/highly/sensitive/data.php";
}
?>
share
14  
It should be noted and emphasized that register globals has not been enabled by default since PHP 4.2 (all the way back in 2000), is deprecated in PHP 5.3 (2009) and will be removed entirely in PHP 6, but people still keep going back to the "OMG register globals" well even after 10 years. –  user8 Sep 14 '10 at 20:28
1  
Pretty Hopeless PHP –  SHiNKiROU Sep 23 '10 at 22:57
1  
It's not hopeless, it's just so far behind so many other languages that the only reason anybody uses it is because it was until recently a lot easier to get cheap webhosting for it than other languages. –  intuited Oct 19 '10 at 7:40
show 2 more comments
up vote 22 down vote accepted

Allow Null by default, the "trillion"* dollar mistake. Sorry Tony Hoare. Almost every language available on planet.

Tony Hoare explains

*I adjusted the expression coined by Tony Hoare to reflect actual loss on these days :-)

share
21  
You accepted your own answer on a question like this? –  Kyralessa Nov 1 '10 at 23:49
show 3 more comments

C and C++ MACROS. If I ever have to see another compiler error due to someone choosing a standard function name for their macro which screws up my code I'm going to scream. Let's see the last offending one:

#define vector(int) new VARIANT[int];

Aaarg! What have you done with my STL vector!?

share
4  
Agreed, but only because modern languages have found replacements for the functionality of textual macros. Back when they were invented, macros were a Good Thing because compiler technology was so primitive. –  dsimcha Sep 14 '10 at 4:26
2  
@Jason: I'm not knocking Lisp-style "real" AST macros, which are still useful and cool. I only hate C/C++-style macros that work purely at the textual level, have no concept of scope, allow one to create ridiculously leaky abstractions and obfuscated code, and can be completely made obsolete by more modern features, one of which, ironically, is "real" macros. –  dsimcha Nov 27 '10 at 19:25
show 6 more comments

Fallthrough by default in C and C++ switch statements.

share
18  
This is always a helpful feature in all of the code I've written. How is this a misfeature? –  greyfade Sep 10 '10 at 14:24
6  
@greyfade: It's helpful until you forget the break statement, or someone adds a case between two cases (or re-orders them), not noticing there was fall-through between them. I don't see any way that fallthrough is better than the C# way of requiring either a break or goto case, etc. –  Tim Goodman Sep 14 '10 at 15:57
9  
Duff's Device scoffs at your impunity! –  Jesse C. Slicer Sep 14 '10 at 22:20
3  
i agree. By default is not a good feature. –  acidzombie24 Sep 18 '10 at 5:45
11  
Does no one read? He said fallthrough BY DEFAULT –  Matt Olenik Sep 24 '10 at 14:20
show 4 more comments

Implicit type conversions when the types being converted between have no obvious relationship. For example, converting a random, non-numerical string into an int, like in PHP.

share
7  
Should be noted that once you get your head around it, this sort of thing becomes a non-issue. It's only really a problem if you don't do any checks in critical areas for user entered values, but is infinitely useful if, say, you know something will be a number, but comes as a string. For example, a field from a DB will likely be returned as a string, and you don't want to worry about casting it. –  Slokun Sep 24 '10 at 19:27
2  
@Slokun: Can you come up with a better example? Why store integral values in a db using a string type? –  Steve Evers Oct 2 '10 at 2:58
show 3 more comments

goto: although ok in rare cases, it is more often misused and leads to hard to read programs.

share
3  
I've seen the opposite where allowing the judicious use of goto would have saved a program from being 3 million lines of code. –  Dave Sep 24 '10 at 19:24
2  
Ah, hyperbole... A valid literary technique. –  Robert Harvey Nov 1 '10 at 22:09
show 1 more comment

NONE

Just because a feature gets misused frequently does not make it harmful.

IMHO the entire "is considered harmful" is the Reductio ad Hitlerum of programming language discussions.

Most, if not all, of the "harmful" features have, or had originally, a very valid use case or are simply convenience methods in the first place. It is up to the developers to understand the pros and cons and code accordingly.

If your questions was meant to be something along the lines of "what language features have common pitfalls or unfortunate side-effects" my answer would be different.

[edit] To be clear: I do not mean the continued use of deprecated methods. If the developers are depreciating/removing a feature you should use the replacement. I am referring to concept that a current part of the language is considered harmful because some do not like what it encourages or the trade-off involved in using it that many people discuss.

share
13  
I disagree, a good counter example is my answer. PHP register global was just bad, no mater how you use them. This is why it has been deprecated and strongly advise to never use on older version of PHP. –  HoLyVieR Sep 13 '10 at 18:23
5  
+1 Put in wrong hands, any language construct is harmful. –  mouviciel Sep 14 '10 at 20:37
5  
Good point... even if 95% of gotos are bad, the feature itself is still worth having for the other 5% –  eds Sep 14 '10 at 23:53
1  
I think it's more like putting the ejector seat button next to the radio on/off button. The feature itself might not be bad, but not preventing harm by accidental use of it is. –  LennyProgrammers Sep 24 '10 at 8:54
1  
I think this is the programming equivalent of "guns don't kill people, people do". –  Orbling Nov 27 '10 at 1:11
show 7 more comments

Autovivification (or other bind-variable-on-(assign|use) feature) is the feature which I've found to give me the most bugs.

share
show 1 more comment

"Failing silently" in Flash Player as default behavior

Ok, not really a feature of the language itself but still pretty closely related.

Suddenly your Flash/Flex application stops working and nobody can give you the slightest hint what the f* has happened. No error message, no stacktrace, no nothing. It's just that suddenly the screen transition doesn't happen (or happens in a completely wrong way), or buttons don't react to clicks any longer, or comboboxes are empty instead of being populated with some entries.

That "feature" alone is responsible for several shrug reports and a whole bunch of gray hair I've been getting. -.- While popping up some cryptic message in the user's face isn't desirable either, it can at least help the developer getting the problem fixed.

But Flash Player leaves you stabbing around in the dark, relying on the user's description (while the problem may actually originate from a completely different location in the code that doesn't have anything to do with what the user was doing). Only if you use the Debug Player you actually get the popup window with an error message and a stacktrace.

However, it can be quite interesting to watch flash embedded movies on certain news sites and get repeated messages about Null references from the used embedded player SWF. :D

share
3  
Failing silently in anything is pretty lousy. –  fennec Oct 3 '10 at 19:18
show 1 more comment

Although some folks disagree with the man or various things he says, a lot of Douglas Crockford's JavaScript: The Good Parts is basically this question applied to JS. Amongst Crockford's complaints:

  • Global scope by default for everything (DC shows how to use function/objects as namespaces and scope delimiters to wrangle this in.)

  • Statements like with, whose failure behavior is to define things at the global namespace. (Gah! Its like the JS motto is if you fail, then fail as hard as possible!)

  • Unexpected behavior with the == operator, which basically requires you to always use the === operator.

  • Semicolon insertion.

Really a whole lot of JS should be considered harmful, maybe even the whole language, but the good parts are just so darn good that it kind of makes up for it (at least for me.)

share
add comment

PLEASE in INTERCAL. Don't use it enough, it complains. Use it too much, it complains.

share
2  
That language is not supposed to be used seriously. It was created to be a very 'unique' programming language, so it is full of things (e.g. comefrom - just on top of my mind) that don't make sense. –  ShdNx Sep 24 '10 at 11:15
4  
I thought that it would be obvious, but yes, I am aware that it's not a serious language. –  Alan Pearce Sep 24 '10 at 12:07
2  
Sorry, some people are too serious around here. –  Mark C Oct 4 '10 at 14:15
1  
Just discovered the language last week on Wikipedia and was blown away of how popular it was (and still ist O_O). –  Oliver Weiler Nov 8 '10 at 22:36
show 1 more comment

In C/C++: That assignments are also expressions COMBINED WITH the very similar assignment = and comparison == operators. Not a harmful feature per se, but it's way to easy to introduce (sometimes subtle) bugs by accidentally mistyping the operator.

int i = 10;

someCode();

if(i = 5)
{
    /* We don't want this block to be executed, but it is */
    moreCode();
}
share
show 1 more comment

Access modifiers in Java with package private language default and private programming convention default.

share
add comment

Replacing undefined variables by an empty string in shell without any warnings: rm -rf $nosuchvar/*.

share
show 3 more comments

The ability to turn counterclockwise in LOGO. Wtf, lets just turn clockwise 360 - x degrees.

share
5  
Logo can be used to control a real, physical turtle robot. Sometimes you want the turtle to turn a specific direction, or to turn more than once. For example, maybe you’re programming it to do some kind of dance. –  Daniel Cassidy Oct 3 '10 at 20:10
3  
Yeah, especially in LOGO For Clocks. –  intuited Oct 19 '10 at 7:48
1  
I love Logo (see programmers.stackexchange.com/questions/21028/…) and it is an excellent teaching language, particularly for young people. When I was say 11 and first used Logo most of my class did not know that much geometry, but they got told 90 was a quarter turn and know left from right. So it isn't a negative feature - the same as why we don't multiply by reciprocals instead of having a divide operator. Yes, I know it's a joke. –  Orbling Nov 27 '10 at 1:15
show 5 more comments

Stopping Thread from an other Thread

In Java and in other language you could stop a thread from an other one arbitrarily without giving the time for the thread you stopped to finish properly. This ability have been deprecated considering the huge amount of problem it could bring in nearly all situation.

share
1  
@Jerry Debugging is an entire other thing, it doesn't stop the process, it pauses it. –  HoLyVieR Sep 13 '10 at 23:01
show 3 more comments

Variable Variables in PHP

Just because you $can doesn't mean you $$should

share
1  
As usual, Perl... has the (potentially dangerous) feature available, has an easy best-practice way to turn it off (use strict) and an easy way to turn it on again in exactly the cases you'd want it (no strict 'refs'). –  fennec Oct 2 '10 at 2:32
1  
I have never found a use to have a dynamic variable name. And the only times I did, it made the code unreadable and a WTF moment a few months later when I revisited the code. –  TheLQ Oct 3 '10 at 20:32
1  
@Joe I would challenge you to show me one example where variable variables make a solution clearer. –  Kendall Hopkins Nov 3 '10 at 2:24
1  
The comment was meant as a joke, sorry I didn't make that clear, but since you ask here is the best example where variable variables make a solution clearer. I'll admit it's a rather bad example though. –  Joe D Nov 3 '10 at 17:34
show 4 more comments

The With statement in Delphi comes to mind, although there are cases when it's usefull.

share
show 1 more comment

Arrays in AWK starting at index 1!

share
2  
Arrays in C and C++ starting at index 0! –  David Thornley Nov 2 '10 at 17:27
4  
Arrays in lisp starting at index car! :P –  Joe D Nov 3 '10 at 17:36
show 1 more comment

In Perl, scalar context vs. list context can be tricky. It's got some good points that make certain operations convenient, but occasionally you run into something terrible, like completely changing the meaning of an operator (potentially from a significant distance away in the code).

sub foo { (1..5) }
my @list = foo();           # (1,2,3,4,5)
my $length = scalar @list;  # 5. the length of the list.
my $length2 = scalar foo(); # '' (the empty string. because it's false)

That's just not right.

(It arises from trying to make something that acts sort of like the regular range operator, so you can say something in a loop like next if /start_regex/ .. /end_regex/).

share
show 2 more comments

Python 2.x's relative import syntax. Suppose I have a package x.plugins that adds support for various other libraries for x. And suppose I have a sqlalchemy module in x.plugins so I can add sqlalchemy support to x. What do you think will happen if I add the following line to sqlalchemy.py?

import sqlalchemy

The answer is that the module will try to import itself. What this syntax does is essentially make it impossible to import the actual global sqlalchemy package. Python 2.5 added a way to specify that this is a relative import:

from . import sqlalchemy

...but it isn't until Python 3 that the first syntax was actually gotten rid of (although it can be disabled in Python 2.6+ with from __future__ import absolute_import).

share
add comment

sun.misc.unsafe is my alltime favorite; the collection of "we needed this to implement things, but really, really don't think you should use it."

share
7  
Every good language should have an unsafe package in the standard library. Importing this package clearly shows your intent of doing low-level unportable things. The alternatives are: 1- Having unsafe features in the language itself (C++ for example) and 2- Having to use a different language such as C for doing low level things (Python and Ruby for example). The unsafe package approach seems much better to me. –  imgx64 Sep 24 '10 at 5:28
add comment

FORTRAN common blocks. If you made a simple mistake, one part of an application could clobber another part's globals.

FORTRAN assigned goto statement / COBOL alter statement. Self-modifying code. Danger, warning, flying spaghetti monsters!!

share
show 2 more comments

Object Orientation (from all statically typed languages). I'll wager this feature has, and will continue, to cost vastly more than null pointers. Object Orientation is only good in a dynamic message passing language. So it should be dropped from dynamic languages like Python too (since it doesn't use message passing but conventional subroutine calling).

share
show 6 more comments

magic_quotes in PHP.

Unexperienced developers either rely on it being enabled and thus assume all user input to be escaped for use in a SQL query or rely on it being disabled and thus always escape their input.

When assuming it's enabled and then running the code on a system where it's not it opens gaping wide SQL injection holes.

When assuming it's disabled and it's not, it will result in backslashes being actually stored in the DB, causing ugly/incorrect strings.

There is also no extremely simple way to handle both cases - you need to check if it's enabled using get_magic_quotes_gpc() and then apply stripslashes() on all values in the $_* arrays - since array_map is not recursive you need a custom function for this.

share
show 2 more comments

going out a bit on a limb here - void functions. a function always does something, hence it should either return the result or some other bit of information regarding its success or failure.

share
3  
Pascal had procedures (no return value) as well as functions (return value). –  Jon Nov 2 '10 at 5:40
show 1 more comment

POKE in BASIC...

share
7  
POKE was awesome. –  Shog9 Sep 13 '10 at 19:04
2  
In the early days poke was the only reasonable way you could achieve certain things in basic. Music on an Apple ][ comes to mind... –  Bill Sep 13 '10 at 21:25
2  
You couldn't do much without POKE on a Commodore 64, if I remember correctly. –  MetalMikester Oct 1 '10 at 17:03
1  
Don't forget PEEK, both essential. –  Orbling Nov 27 '10 at 1:30
add comment

I'd have to say garbage collection. It does not eliminate the need to think about memory management, but it eliminates the perception of the need to think about memory management, which all too often eliminates the actual thought, and then you get enormous resource hogs and don't know why. Especially when the behavior of modern generational GCs could be described without too much hyperbole as "one big memory leak by design" anyway.

share
2  
If you've got references sitting around in some collection somewhere, you have other problems. –  Chinmay Kanchi Sep 10 '10 at 15:03
2  
That's why gc'ed languages have weak references :) –  Chinmay Kanchi Sep 11 '10 at 11:39
4  
While GC certainly has both strengths and weaknesses, I'd have to say that Mason is a lot more right than wrong on this one. In fact, I've seen people using GC spend a lot of extra time on memory management because they ended up trying to hack things after the fact instead of planning for it up front. GC also generally prevents deterministic destruction, which leads to extra work dealing with managing all resources other than memory. –  Jerry Coffin Sep 13 '10 at 19:21
3  
@ChaosPandion: Am I really a fool if I think that, on a modern multitasking machine, in order to keep paging from trashing your system performance, memory should be released as soon as possible? No GC has ever managed to even come close to achieving that result, and in fact, the generational garbage collector, which is supposed to be the best, most modern variety there is, does precisely the opposite: for best performance, it has to release memory as late as possible. I don't see that as ever the right tool for any job, not when it slows down my other programs. Am I a fool for that? –  Mason Wheeler Sep 14 '10 at 20:53
2  
@Barry: It's deterministic within the program. If I'm done with a 5 KB block of memory, then ask for another 5 KB soon afterwards, what happens? In a garbage collected system, it needs to request a new 5 KB block, even though there's a perfectly good block sitting unused, unless the GC has run in the interim, in which case you can recycle the old block. With malloc and free, you'll always be able to recycle the old block. Multiply this by a few hundred thousand and it becomes a real issue. –  Mason Wheeler Oct 3 '10 at 22:03
show 17 more comments

The language feature that allows programmers to write uncommented or meaningless-commented code.

share
1  
And how to fix this? –  bigown Sep 24 '10 at 18:17
1  
@bigown: by implementing comment-or-die feature :D. –  tia Sep 24 '10 at 18:50
3  
That's called Literate Programming. en.wikipedia.org/wiki/Literate_programming –  Barry Brown Oct 3 '10 at 21:03
2  
That's not a feature, but it is an extremely famous bug in the user front end, most people know it by its latin name: Homo Sapiens. –  Joe D Nov 3 '10 at 17:39
add comment

C, and definitely C++: Pointer arithmetic. Allowing people to convert integers into memory addresses is asking for trouble.

And maybe even raw access to pointers altogether?

In C++ you have references that makes pointers almost completely unnecessary. For the remaining cases smart pointers should be considered mandatory.

Java is also proves that you can make a programming language that uses pointers without allowing people access to the pointer value itself.

Apart from null ... but that's a different story.

share
5  
Pointers, while difficult to use properly at times, are very necessary for a great number of efficient memory operations. –  Bill Sep 13 '10 at 21:27
1  
True. But allowing people to convert integers into memory references on a regular basis, or adding numbers to memory addresses is mostly harmful these days in my opinion. In C++ you have references as a perfectly good alternative, and smart pointers / auto pointers for when you really need it to be a pointer. –  Asgeir S. Nilsen Sep 14 '10 at 20:15
4  
This answer is only valid if you are working on a software stack constructed to hide pointers. In all other cases, this answer is wrong. –  Paul Nathan Sep 14 '10 at 21:07
3  
Some programming language needs to have pointers available so you can write all the operating systems and virtual machines for the other programming languages. –  fennec Oct 2 '10 at 2:35
2  
-1. There is a reason you need ptr arithmetic: Iterating a point is fast than indexing. for(int i=0;i<SIZE;++i) ++arr[i] is slower than for(int*i=arr;i<arr+SIZE;++i)*i++. All java managed to prove is that you do need pointer, or have you never looked at sun.misc.Unsafe? If you don't need pointers, please explain how to write a generic swap function using Java. (e.g. int a=1,b=2; swap(a,b); assert( a==2 && b==1); ). Not to mention all the problems in c/c++ you'd have if you HAD to use references. How would you call a virtual function on an opaque struct w/o pointers? –  KitsuneYMG Oct 2 '10 at 2:43
show 3 more comments

Not the answer you're looking for? Browse other questions tagged or ask your own question.