PHP Sucks
What Evert is referring to (the &quot;reputation&quot; of PHP and people&#x27;s reactions) is even worse in infosec. I very frequently get accused of being a charlatan simply because I write PHP.<p>Some people openly question if a PHP developer who understands security <i>exists at all</i>: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;MalwareJake&#x2F;status&#x2F;506488937096183808" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;MalwareJake&#x2F;status&#x2F;506488937096183808</a><p>This is silly when you think about it. If so many systems run PHP, wouldn&#x27;t you <i>want</i> your infosec people to know PHP and work with it more often? Why are we, culturally, encouraging such a blind spot by ostracizing folks who know it well? That part never made sense to me.<p>This conversation plays out more frequently than I like:<p><pre><code>  Rando: Hahaha PHP security is an oxymoron.
  Me: Okay, then hack paragonie.com. It runs PHP. Logically, you should
      be able to hack it _just for running PHP_ if PHP is so insecure.
  Rando: But that website&#x27;s mostly static content!
  Me: Yes, but it runs PHP. So it must be insecure, right?!
</code></pre>
So far, despite giving people permission so the prospect of CFAA convictions don&#x27;t discourage them, none of these &quot;PHP is inherently insecure&quot; folks have succeeded. I wonder why. :)<p>TL;DR - A lot of the hate against PHP is founded on ignorance and peer pressure. Be open to constructive criticism, of course, but a lot of the hate you&#x27;ll hear is bullshit.