Oct 22, 2026, 5:13 PM@mhoye The *concept* of PHP is good, but the *execution* is terrible.
- Oct 22, 2026, 5:13 PM
Replies
mhoyemhoye@cosocial.caOct 22, 2026, 10:26 PM@krapp the execution of PHP has been underneath most of the Web for most of the time we’ve had the Web.
- Oct 22, 2026, 10:33 PM
@mhoye And it's been an endless clownshow of vulnerabilities, SQL injections, shell injections, XSS and nonsense for most of the time we've had the web.
The problem with PHP is that its simplicity is deceptive. You have to use a framework that understands context because you *will* forget to escape a variable, or not escape it properly. You have to use proper database management - PDO and prepared statements. You have to secure sessions and cookies. You have to *know* about
- Oct 22, 2026, 10:36 PM
@mhoye dozens of edge cases and step through countless hoops just to avoid the obvious vulnerabilities, and if you're using Wordpress, you have to deal with plugins and the decrepit nature of the framework itself.
Using PHP properly is *hard*, and even when it's used properly sometimes there's just some bullshit baked into the language that will give anyone root anyway.
It's not a good language.