That’s the problem with PHP. It’s quite easy to build something that works. It’s quite another to build something that works and is secure, scales well, is maintainable, etc. The thing is that ‘it works’ is something that people see immediately. Those other things they only get to experience when it’s too late.

This is compounded by the fact that because it’s so easy it attracts a lot of inexperienced developers who don’t even consider things like security. Add to that that the language is full of footguns.

That’s not to say it’s impossible to build good apps in PHP, but that is despite the language, not because of it. It takes experience, knowledge and discipline to write something secure and maintainable in PHP. Something a lot of PHP users don’t have.