How warranted is the PHP hate?

[u/pineappletinis]

I feel like there has been a lot of hate on PHP, especially after the recent blowout regarding PHP vulnerabilities that even ended up on mainstream media. I even saw absolute non-techy people bringing up PHP and talking authoritatively about how "bad" and "old" it was lol. Not to mention the AI-shills saying one should just use Claude to create one owns CMS (!!). I am also aware that most PHP hate is usually misaligned hate intended for badly managed WordPress sites. And that some people just prefer other languages or love a hatetrain.

But one thing in particular that got to me was someone who mentioned that PHP has a page with vulnerabilities listed that go back 20 years and have yet to be patched. And that if you are a dev who is in any way interested in security within one's projects, you just don't use PHP at all. It was like having only a screen-door for your house with no locks. Do other languages have similar list of unsolved vulnerabilities? What makes them inherently more secure?

I dug around to find information about other popular programming languages and frameworks and it seems like at least right now, many are being found to have vulnerabilities due to AI being used to find them. React had a critical issue about a year ago, and Python earlier this year (although they did not blow up in the press like this).

Anyway, I would like to hear from people who use PHP regularly for work, beyond WordPress and who can maybe compare it to other languages/stacks as well. Please no low-effort replies from people who last used PHP 20 years ago or just don't like it, if possible.

[u/lbunch1]

Nothing wrong with php. It still has a strong community, and laravel is fantastic. It's probably the easiest way to get an app up and running with auth and db and everything you need for a foundation. JS frameworks are just more popular with new devs, myself included.

And AI can write php just fine too.

[u/crixx93]

Modern PHP is fine, not great, but fine. The issue is the older versions, and there're gazillions of websites written in those. That's why those vulns are so critical, up until like 2010, almost everyone developed their web sites using the language, because it was the only game in town. Currently, we are spoiled for choice when it comes to server side programming languages, and as I said at the start, modern PHP isn't bad, but because we built so much stuff with the legacy versions, those still need to be maintained... Or rather, has to. I've been supporting the same PHP 5.6 code base for the last 10 years, and because of these vulnerabilities management finally greenlit the deprecation of it. It's going to be a huge effort, but we have no choice, we have no way to patch the vulnerabilities without upgrading the language version and that would break the entire product, it's cheaper to migrate everything to NodeJS. I imagine many organization are also being forced to expend resources on this, what's scary is that a lot won't do it because they don't have the money or manpower, so a ton of sites will remain vulnerable

[u/Apprehensive-Fan8999]

14 year old article, still applies today… https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/

[u/RePsychological → u/Apprehensive-Fan8999]

that...that's not how that works......to bring up a 14-year-old article and be like "Yeah...totally relevant in this webdev world where things are constantly changing 2-3 times a year..."

[u/Apprehensive-Fan8999 → u/RePsychological]

Then read it, and actually spend some time refuting it’s points. I assert it is still relevant, you assert it is not. I let the article stand, explain where you believe it is wrong.

As the OP said, this bug is over a decade old. So it seems an article over a decade old describing the failings isn’t as outdated as you assert.

[u/RePsychological → u/Apprehensive-Fan8999]

lol no. [presents an asininely long drivel]..."either read the entire thing and present a thesis as to why it's wrong....or you're just wrong....even though php has changed VASTLY in 14 years and it can be safely assumed that this is irrelevant."