Member-only story
Think Php2Shell Was Bad? PHP Is About to Face an Absolute Bloodbath
I’ve been writing PHP since 1999, before everyone migrated from Rasmus Lerdorf’s original PHP/FI 2.0 to PHP 3.0. PHP3 was a complete rewrite of the original. It even came with a new *.php3 file extension instead of the commonly used *.phtml or *.php extension. PHP had design flaws like register_globals and magic_quotes_gpc between 1998 and 2012, alongside severe security issues like CVE-2006–2563 in PHP 4.4.2 to 5.1.4 from 2006. Even back then, it had a bad reputation and was not well regarded. I still remember the endless debates with Linux admins about PHP.
Much of PHP’s security issues related to memory management in C (e.g. CVE-2006–2563), but that by far wasn’t the sole or even main cause. PHP’s design philosophy was largely “make web dev as frictionless as possible for beginners”. PHP implemented language features that left experienced programmers scratching their head. Even if PHP was rewritten in Go or Rust today, these issues would largely remain. I’d even go so far as to say that it’s not even the language itself that is at fault.
Why people even use PHP
Today, there’s zero reason for an experienced polyglot programmer to pick PHP over any other language like Rust, Go or C++. PHP flourished during the Dot-com bubble, when everyone needed to build…
