@mhoye I agree with the main thrust of your argument but unlike BASIC and dBase and other historic tools that enabled users to just do stuff PHP exists in a space exposed to attack and basically hands the user a set of traps to fall into.

If PHP was just for local unexposed page formatting it would be fine