Why do you not use C for your web apps?

I was having a look at a few different web servers this morning when I came across G-WAN. As I understand, its a web server written in C and you have to make use of it by writing your websites/webapps in C. One clear benefit is speed as the G-WAN site suggests.

However, on the forums, the creator of G-WAN asked why not use C for web based apps and I can not think of a single reason apart from it being difficult (for me anyway, I am newbie when it comes to C). There must be more reasons why we all use PHP, Python, Ruby etc apart from it being easy to develop in these languages. I don't see that as a good reason.

So I put it to you: Why do you not use C for your web apps?

It takes a great deal of care to get a C program correct and secure. That care means that you need to have really good people writing your programs. That means you pay more.

Also, C doesn't have the benefit of drawing from an enormous single standard library of functionality as .NET (and the other major web-centric platforms) has. So you may have to either buy components, or perform interop, or roll your own functionality which comes "for free" with a more, shall we say "web-centric" language like PHP or C# or Ruby or whatever. That means you pay more.

Add all of that to the fact that single-threaded computational speed just isn't that important on the web. If you need more scalability, most organizations can economically just throw more cores at the problem and be fine. This is not true for everyone, of course. I'd imagine that the core of Google's engine is written in C or a similar language not only for speed, but to save real money in power costs.

Hum...

It seems that I am a bit late in this discussion - but I just discovered it now. And I am grateful to all of you for so much input.

I am G-WAN's author, which makes it clear that I have seriously worked on the matter: G-WAN is both faster than all other Web Servers (no processing) and all other Web Application Servers (any processing you can imagine).

Yes, ANSI C also made it possible to process more static content - with less powerful CPUs (ANSI C is not only about making dynamic contents fly).

By the way, G-WAN uses C scripts (no C compiler and linker needed) so the compiling/linking cycle/delay does not exist.

In the process of comparing G-WAN to .NET Java and PHP, I wrote similar applications in all 4 languages: http://gwan.ch/source/

And, to my dismay, the modern scripting languages were not easier to use.

One part of the job which is especially frustrating is to desperately search for the 'magic' API call that will do what you want to do.

Think about how to do 'pretty thousands' in:

C#

String.Format("{0:n}"...

Java

new DecimalFormat("0.00"); ...

PHP

number_format($amount, 2); ...

ANSI C

sprintf("%'.2f", amount);

The "..." mean that some pre-configuration, or post processing, is necessary. ANSI C is clearly easier to use and to remember.

When PHP has more than 5900 API calls (C# and Java not far away), finding the right API call is a challenge on its own. The time wasted to find this (and then to find how badly the native API call is implemented), the time to learn by hart it for the next time you need it, all this time is depriving you from the time necessary to resolve your application problems.

I have read (above) that PHP is more concise than ANSI C? Why then use "//:: this is a comment ::" rather than "// this is a comment"? Why have a so stupidly complex 'pretty thousands' syntax?

The other usual argument is that Java and the like provide dedicated calls for Web applications.

I was not able to find anything to escape HTML in Java so I wrote my version of it:

  // all litteral strings provided by a client must be escaped this way
  // if you inject them into an HTML page
  public static String escape_html(String Name) {
      int len = Name.length();
      StringBuffer sb = new StringBuffer(len);
      boolean lastWasBlankChar = false;
      int c;

      for(int i=0; i<len; i++) {
          c = Name.charAt(i);
          if(c == ' ')  sb.append("&#32;");  else
          if(c == '"')  sb.append("&quot;"); else
          if(c == '&')  sb.append("&amp;");  else
          if(c == '<')  sb.append("&lt;");   else
          if(c == '>')  sb.append("&gt;");   else
          if(c == '\n') sb.append("&lt;br/&gt;"); else {
             c = c&0xffff; // unicode
             if(c < 32 || c > 127) {
                sb.append("&#");
                sb.append(new Integer(c).toString());
                sb.append(';');
             } else
                sb.append(c);
          }
      }
      return sb.toString();
      //szName = sb.toString();
  }

Do you really believe that the same code in ANSI C would be more complex? No, it would be both immensely simpler and faster.

Java (derived from C) is requiring programmers to link multi-line strings with a '+'
C# (derived from C) is requiring programmers to link multi-line strings with a '+'
PHP (derived from C) is requiring programmers to link multi-line strings with a '.'

ANSI C does not have this now completely stupid (obsolete) requirement.

So, were is the so obvious progress claimed by the modern languages? I am still looking for it.

Sincerely,

Pierre.

The same reason we don't use C for most programming. The benefits (which are mostly performance) don't outweigh the costs (development time, lack of automatic memory management, lack of automatic protection from buffer overflows, having a compile stage between the edit and test stages, etc).

Most network applications, especially web servers, are far more "I/O bound" - ie they are capable of pumping out data far faster than the network can accept it. Therefore something that is highly CPU efficient is not a huge win, whereas something that is scalable and maintainable is. So there is no reason to accept the drawbacks of C and lose the advantages of a managed environment like Java, .NET, Python, Perl or other languages.

C isn't a convenient language for manipulating strings.

Compare C#:

string foo = "foo";
string bar = "bar";
string foobar = foo + bar;

Corresponding C:

const char* foo = "foo";
const char* bar = "bar";
char* foobar = (char*)malloc(strlen(foo)+strlen(bar)+1);
strcpy(foobar, foo);
strcat(foobar, foo);
//todo: worry about when/where the foobar memory
//which was allocated by malloc will be freed

If difficulty and complexity were not an issue at all (ha!), then I wouldn't stop at C. I'd write x86 assembly. It's been years since I've used any web server that wasn't x86, and it's looking less and less likely every day.

To use C (instead of assembly, or something higher-level) is to suggest that C is the sweet spot of programmer efficiency and computer efficiency.

For the programs I write, this is not the case: C is a poor match to the kinds of programs I want to write, and the advantages of it over a decent macro assembler just aren't that significant. The program I'm writing right now is not hard in my HLL of choice, but the complexity of it in either assembly or C would be so high that it would never get finished. I acknowledge that a sufficiently smart programmer with enough time could make it run faster in assembly or C, but I am not that programmer.

• it's insecure

• it's hard to read

• it's hard to maintain, development time is slower on the order of a magnitude

• most of your web stuff is probably I/O bound, so the would be speedup doesn't even matter, especially when you use a fast language like Java or C#

I know this question has already been answered to death, but there are 2 things not mentioned so far that are extraordinarily important to success in any programming paradigm, and especially in web development where you get a lot of people that aren't necessarily programmers, working with the code.

1. Involved, useful community, aka People That Have Solved My Problem Already. It's pretty easy for even the noobiest of noobs to Google why they're getting "headers already sent" errors in PHP, whereas that information might not be available for a framework or language that is new to the scene, or otherwise doesn't have critical mass.
2. Frameworks, so that most programmers can get to solving business problems and not hacking code together.

If I had a critical app that required extreme performance, I would use C, but it would take so much longer to write, that I would never get to market. Until there is either #1 or #2 it's not feasible for me to use it.

C is quite low level languages for many purposes: no-OOP, lots of manual resource management.

There is limited use of C for web, for example Klone. It is mostly used for low resource embedded application cases.

However there are C++ web frameworks like CppCMS that are used for high performance web applications developments.

C++ allows you to enjoy high abstraction and fine grained access to what you are doing exactly giving much better option for deploying and developing large applications.

But you use them in case when performance and resource usage is much more critical then time-to-market and development costs as generally web development is faster using good web frameworks for languages like Java, Python or PHP. Also generally there less competent programmers for C++ then Java/P* languages for same salary.

So it is question of priorities, also there less tools for C++ Web development then for PHP/Python/Perl or Java.

> There must be more reasons why we all use PHP, Python, Ruby etc apart from it being easy to develop in these languages

This is the entire reason and the only one needed. It has many benefits, chief of which is time to market. If you can get your Web app online in a month using PHP instead of two months using C, you might just win. If you can add a new feature in a week using Ruby on Rails instead of two weeks using C, again you win. If you can fix a bug in a day using Python instead of two days using C, you win once more. If you can add a feature because you are using language X that your competitors cannot add at all because they are using language Y and it's too hard in that language given their resource constraints, then you definitely win.

And by "win" I really mean you don't lose. Your competitors are using higher-level languages and frameworks to develop their sites, so if you use C, you are not competing with other people who use C, you are losing against other people who do not use C. Just to compete, you have to use tools with similar levels of abstraction.

If performance becomes an issue, you can rewrite the slow parts of your site in better-performing languages. Or you can just throw more hardware at it. Really, a performance problem is what we call a "nice problem to have" -- it means you have already succeeded. But spending more time developing the basic functionality of your site is rarely an option. Writing it in C just so it will run faster is premature optimization, which, as Knuth tells us, is the root of all evil.

All this implies that if you can use a language with a higher level of abstraction than Python or Ruby, you could win against people using Python or Ruby. Paul Graham's story of how he and his team used LISP as a "secret weapon" in developing Web sites may be instructive. http://www.paulgraham.com/avg.html

Of course, if you are developing a site for your own amusement, do it in whatever language you want. And if your site is CPU-bound (hardly any are; they are usually I/O bound) then use the fastest-performing language you can. If you are trying to innovate, though, use a high-level language with the best abstractions you can find.

@Joeri Sebrechts

F.U.D. in action:

> PHP, Python and so on are easy to scale up by throwing hardware at the problem.

Well, actually no. They don't scale at all vertically and scale very poorly horizontally. See: http://gwan.ch/en_scalability.html where it is explained how much trouble is ahead of bad-performers.

> Suppose it costs 1 person 1 year of effort to develop an app in PHP, and it costs > them 3 years to do it in C (as C requires more effort to do the same thing).

Wrong again. If PHP libraries have been written in C then they are directly usable from C -instantly providing the 'unique productivity' you are claiming PHP has.

> That means the reduced hardware need of the C code has to represent 2 years > worth of wages for C to become attractive. In practice that (almost) never happens.

Pure F.U.D. (see the answer above).

> Facebook's scale is so large that hardware is a big enough cost to care. > That's why they developed HipHop, which cross-compiles PHP to C++. > It brings the best of both worlds: the simplicity of programming in PHP, > and the raw performance of C++. Facebook is still developed in PHP, but > when you use it, it's all native code.

HipHop is much faster than PHP, no doubts on that. But if you compare HipHop with a plain-C implementation you have two layers of overhead:

• the PHP to C++ interfaces (which use the bloated C++ libraries);
• the C++ bloat itself (which makes C++ 2-10 times slower than plain C).

Plus, HipHop has been written in the clueless inefficient Academic mode (detached from any real-world reality). sure, it can impress PHP coders but show this code to an embedded programmer and he will feel sorry for Facebook.

"A language that doesn't have everything is actually easier to program in than some that do" --Dennis M. Ritchie

Unlike (most of the) programming language END-USERS, Dennis knew a couple of things about the matter, it seems.

You think being easy is not a good reason. I think it's a good reason. If you need ultimate performance then C is ok, but other languages abstract away the hard stuff to improve productivity, maintainability and reduce defects.

Consider that I'm not a web developer but will ask these questions anyways and offer a point or two.

What web site is only written in one language? Seriously this thread seems to assume one hammer fits all nails.

When was the last time anybody seriosly stated that C was complex? I mean really guys you can't get much more low level. I'm not talking C++ here as the two are often referenced collectively.

C has security concerns, that can't be denied but are they any less than what is seen in the kludges called PHP & Perl? In either case a secure web site is a function of programmer discipline.

In any event off to the comments. The difficulty of using any given language is very dependant on the problem at hand C & especially C++ can lead to fast solutions to a problem in experienced hands.

Industrial uses for web servers, that is embedded servers/sites simply don't have the language choices a normal web server might have. So you end up using a variant of C or possibly something like BASIC. Your goal is to offer up the functionality the device requires and not to worry about languages. On a mainstream web server the way to do that is with high level languages most of the time. Walk away from big iron and your programming freedom goes out the door.

Without the right Libraries it would be foolish in most cases to do a ground up web project in C. The lack of good standardized libraries is a big negative here.

Here is some more web-related code written in C that is worth a look when building your own C library for the web:

• cgic: an ANSI C library for CGI Programming
• cgit: a web frontend for git repositories
• wbox: HTTP testing tool
• wget html-parse.c
• curl cookie.c
• Discount, David Parsons' C implementation of John Gruber’s Markdown text to html language
• Protothreads (esp. for embedded systems), http://www.sics.se/~adam/software.html
• protothread, Google code project by LarryRuane
• uriparser sourceforge project
• http-parser, http request/response parser for c by Ryan Dahl on github
• nginx
• ...

Well, given the fact that Web development is a matter of having useful libraries (the kind used by PHP) then I do not see how C would not be useful.

After all, the procedural logic is the same: do while, for, if then else, etc. whether this is C, PHP, .Net or Perl.

And a C loop or test is not more difficult to write because it is written in C.

Most PHP libraries are made in C so the missing-C-libraries-for-the-Web argument does not look that much convincing.

My guess is that C was not advertised as a Web programming language by the promoters of Java (SUN) and .Net (MICROSOFT) because they had their own proprietary (heavily patented) intellectual asset to push for adoption.

As a free (unpatented) standard, C does not offer any 'lock-in' grip on developers... hence, maybe the heavy hand of lobbying in schools and universities to make sure that tax-payer money will fund the adoption of an inferior technology backed by private interests.

If C is good enough for IBM and MICROSOFT (they don't develop their products in PHP or .Net) but not good enough for end-users, then end-users might wonder why they are invited to suffer this double-standard.

I would use C for a web app if:

1. I have a little budget for the hosting server (small VPS) and my time is not expensive.
2. I am working for Facebook, Twitter or someone in need to reduce the amount of servers used (with thousands to millions of users).
3. I want to learn C and I need to find a real world app where I can use it.
4. I know C much much better than other scripting languages.
5. I am an eco guy and I want to reduce the carbon footprint of my app.

G-WAN runs code as scripts, yes C scripts like Play! Framework does for Java. G-WAN is very fast and has an easy API. G-WAN makes possible to use C/C++ for web apps when other servers has failed to do that.

One thing is clear: you need a good programmer to write a web site in C, any crappy developer can create a site with spaghetti PHP :-) There are leak detectors and even garbage collectors for C.

All the languages you mentioned are actually written in C/++. The only difference is the advanced classes and libraries that were created from C that make up what is now these other interpreter languages. It is also why they are referred to as scripting languages.

Think of it like baking a cake (PHP/JS):

• 2 Eggs, 1 cup Milk, 2 sticks of Butter, 4 cups flour, 1 cup Sugar, Baking Soda

But imagine having to make all the element that those things are composed of. (C/++)

• 17 mg of sodium bicarbonate, 15 tbs of protein, 12 tbs of Vitelline Membrane, Amino Acid, Sulfur, ... Neutron Particles

C is the foundation of many modern languages. It is great and almost the most powerful languages under assembly. You can do it you just need to invest in building all the code that these other languages already did. Like building a cake from the periodic table.

Learn it you can literally make it do anything!

String handling in C can be made easier using:

> Data Types (part of libslack) > > Libslack provides a generic growable pointer array data type called List, a generic growable hash table data type called Map and a decent String data type that comes with heaps of functions (many lifted from Perl). There are also abstract singly and doubly linked list data types with optional, "growable" freelists.

or:

Managed String Library (for C)

http://www.cert.org/secure-coding/managedstring.html

Another point might be the platform dependency. C needs to be compiled into native code. This code doesn't run on all platforms.

Interpreted languages run wherever an interpreter exists. Many providers for example provide PHP-Interpreters installed on their servers but with a Windows OS. If you now are developing on a Linux-machine. You've got a problem.

Of course this problem could be solved but you see the advantage of developing in PHP in this particular case.

Hope this helps, regards domachine

"domachine" wrote:

> platform dependency: C needs to be compiled into native code. > This code doesn't run on all platforms. > Interpreted languages (like PHP) run wherever an interpreter > exists. Of course this problem could be solved but you see > the advantage of developing in PHP in this particular case.

Did you ever wonder in which language the portable PHP interpreter is written?

In ANSI C.

So, before you dismiss the portability of ANSI C again, ask yourself in which language your favorite programming language has been written... (tip: almost all were written in C/C++).

ANSI C compilers are available on all the platforms I had to work on -and the same is not true for PHP and its gigantic runtime.

So much for the portability argument.

Similar to G-WAN, but for Cocoa / Objective-C is Bombax, a web applications framework.

http://www.bombaxtic.com

Speaking of Objective-C I can't resist pointing out MacRuby, which has the potential to revolutionize the way we will make web apps one day.

PHP, Python and so on are easy to scale up by throwing hardware at the problem.

Suppose it costs 1 person 1 year of effort to develop an app in PHP, and it costs them 3 years to do it in C (as C requires more effort to do the same thing). That means the reduced hardware need of the C code has to represent 2 years worth of wages for C to become attractive. In practice that (almost) never happens.

Like with every rule, there is an exception. Facebook's scale is so large that hardware is a big enough cost to care. That's why they developed http://developers.facebook.com/blog/post/358">HipHop</a>;, which cross-compiles PHP to C++. It brings the best of both worlds: the simplicity of programming in PHP, and the raw performance of C++. Facebook is still developed in PHP, but when you use it, it's all native code.

In the end you can use absolutely any language to develop sites, including assembler (via CGI etc.). If you meant why don't we use a compiled language, well, we already got .NET, Java and others.

You have to love what you're doing to achieve results. Languages like java and php were created with lot of effort to make people's lives easier. Php especially has benefited many self learned web programmers today. You can see the kind of support it has in the world of web development.

Java iam sure was written to give you help in anything that can be possible in today's world. The enormous book is a clear indication, and it's a beast if you are looming for web development as well. Same goes for Python. These are so.e fantastic languages and platforms. No wonder they are hugely popular.

I am a C devotee and partly it's due to certain limitations which precluded me from giving a look at other languages like php. I am writing in C daily and every day I am proud to e and learning a new thing also. This makes me feel very good and I have also started learning about how C was the default choice when writing applications for websites through Cgi. This is abstracted in other platforms and when you develop websites that have to do with databases and web services, you need to know what's happening behind the scenes.

However if you know all that and still want to use a scripting language, there must be a valid reason, and we don't need anyone to advise against that.

10+ years have gone by since the OP asked this, and Google search trends (within the genre of web programming) still show this as an active debate. I want to give a 2021 answer to this one, and since I've been programming professionally since 1979, and have used every aforementioned language exhaustively, I feel quite qualified to answer it.

• More internet devices use C than any other language. They just aren't usually the public facing devices per se (Cisco, F5 networks, etc -- their cores are all compiled in C). But these are embedded platforms with a purposeful function that require almost RTOS-like stability. C will continue to be the dominant language here - it's so old that instability issues aren't a factor.

• Big Tech uses C all the time ; you aren't going to find a cron job in their stack that does does a log flush or backup being written in bash or in PHP ; if it's complex it's likely that it's a gcc-linked binary that's doing the heavy lifting. Nothing is as reliable as C since it's been around forever and we're not finding new bugs in gcc.

• The tech companies during the 1990s really built up the core of the technologies we use today, and C wasn't sexy [at all] to use. Many apps were developed with Java Servlets and applets which is quickly conducive to an MVC model and it's cross-platform. The latter is very important - as I'll explain.

• Microsoft didn't quite embrace C or C++.. their Visual C was a terrible IDE compared to Borland's. But Visual Basic was a hit for them, though, which is why VB became ASP classic - which many websites still use today. It was the first language IIS officially supported (VB or Basic). Classic ASP is considered an old language with no support from MSFT anymore, but its usage was widespread in early web apps who wanted to use Windows NT (or Server) for their development. Bill Gates really wrote the best Basic interpreter back in the day, and the simplicity of Basic allowed for a very quick learning cycle to become a developer. However, Borland's IDE was amazing, but the company blew up (along with Novell and other greats from the 90s).

• Nobody in their right mind in the 1990s were developing web apps quite yet for Linux, really.. other Unix derivatives, yes - but commercial versions of them. Many people deployed completely different OS's altogether (think of AIX or DEC VMS here). The words "free" and "great software" wasn't often part of the vernacular. IT managers, who became the de-facto original webmasters, didn't want their paycheck to ride on something free (Linux) because in part the distributions were fragmented (perhaps excluding RedHat's or Mandrake's).

• IT Managers weren't programmers - so scripting languages became more popular for web development. Websites written completely out of bash were not unheard of.

• Java (which is based on C) became perhaps the most popular notion of the future of the web, partially because Sun had great hardware and was renowned for their Solaris OS. Most C programmers who were interested in the web moved onto Java, it was pretty similar and offered concurrency (C wasn't designed as a concurrent language) and mostly stable garbage collection and memory clean up techniques.

• VB devolved at MS and, seeking a compiled language for IIS, moved it up to what's now the .NET framework which is simply VB or C# wrapped in complexity. But IIS's weaknesses were overcome by the sheer number of Windows NT/2000 deployments.

• The bubble burst and Oracle's Java, Solaris and DBs weren't a favorite amongst IT managers (though it was a favorite with executives because Oracle's sales team were top-notch). For one, Oracle's products were extremely expensive and they weren't (and really still aren't) known as a cutting-edge technology company.. they are the IBM of late - deploying what works and isolating more of the business problem than the technical one.

• Post-Y2K, Linux out deploys just about everything on the web because the distributions started really getting to a commercial-level. This whole idea of open source was working. Windows was suffering from virus issues repeatedly and Apple was written off as a dead entity. Commercial platforms were becoming more under fire as CFO's were tightening budgets.

• Linux started with a legacy PHP interpreter from the get go and the language has really grown from there. Most who deployed Apache would use this language simply because it was stable. Again, at this point we still have IT managers running these efforts.

• Mid-2000s when Marketing functions started taking over the web presence of their respective companies, the needs quickly changed. Marketing folks love testing (think multivariate A/B campaigns) and so scripting languages really started sneaking up as the best way to accomplish quick changes that could be pushed to the web without having to hardcode HTML.

• We forget, the ECMAScript (Javascript) really took off, Flash started to die, and so this whole idea of how to control the DOM came about when faster and faster browsers were able to leverage the UI.

• Of all the modern languages out there, the frameworks really have usually been responsible for propelling the success of newer languages. Bootstrap was quickly absorbed when mobile came about, and integration with a legacy PHP app was easier than it would have been with a hardcoded C app. We started seeing mostly scripting take over compiled languages as the choice-du-jour, though .NET has it's place for certain things yet, though that's diminished in the last 2-3 years.

In the end, C is still the most widely used language "behind" the internet. Routers, load balancers, intrusion detection systems.. it'll all be in C (or C++ but more likely, C). These appliances are now moving to being software deployed but the hardware appliances are still used by the larger datacenters. For example, AWS has a wrapper around a grouping of Cisco switches to change the routes based on ToD (time of day) predictions. Amazon, Google, Facebook all realized that a "follow the sun" model of load balancing was a good starting point and really could only trust that to low level hardware devices to correctly do that. Scripting languages and even compiled ones are surfacing that are - for all intended purposes - really based on C anyway. But with the advent of k8s and Docker it makes more sense to rip a node.js framework and start working on a small unit of code that could be pushed independently of what the other pieces of code was doing. Outsourcing was used alot in the earlier days and this is about the only solid way of programming a system without conflict in a larger development environment.

We are still at the beginning of the internet.. in other words, in another 10 years there will be yet another cycle, and it'll likely be away from typing. Drag and drop DAG nodes will be used to create web apps in a similar way that a VFX artist uses Nuke or Maya to build a motion graphics clip. Twilio does this and even training an ML model is already beng done this way using Peltarion.

We're not yet to the highest level languages possible, as our abstractions in Ruby or PHP are still C-like, and throwing dollars at STEM education won't bring in legions of kids to study computer science. However, the barrier to entry will continually be lowered, but the need for a diverse understanding of languages will still be required for the complex applications or specific applications that require "something" like directly addressing a CUDA core (for example).

We are simply seeing a diversity in languages, as predicted by Ritchie himself, come about. Frameworks have matured so it makes no sense to drop a new developer on a C+CGI project when bringing up an Angular scaffold takes 5 minutes.

This was all expected, actually, by most of us from the 1980s. As programmers become diverse, so do the ways to attack the problem in front of them. As open source becomes evermore possible (and incredible!) there's simply no financial advantage to starting something from scratch. Headless CMS systems in fact are already being deployed so that the backend of the CMS doesn't require the dev team to write a line of code - they just worry about the user experience... and even then, the tools are getting more mature.

My point is this: C is definitely used on the web, and embedded systems use it all the time. MVC applications have progressed to where a framework can build a simple app for you within an hour, without compilation, and it happens that those frameworks are more extensible on the newer languages. It's an apples to oranges comparison for me - I still use C to do data normalization (for example), but if I'm being paid to write a web app, I can begin a Vue.js app while drinking a beer, so why work harder?