I'm very surprised they banned PHP but not C. In PHP, if you make unsafe code, it's your fault. In C, well, it's still your fault because you could theoreticall

I'm very surprised they banned PHP but not C. In PHP, if you make unsafe code, it's your fault. In C, well, it's still your fault because you could theoretically write secure software in C, but professionals with a decade of coding experience still have memory corruption vulnerabilities in their code. Those bugs just can't exist in PHP and so, after you learn some patterns (such as parameterized queries), the number of serious vulnerabilities one typically finds goes down very significantly. The most serious bug you'll typically find (when written by someone with experience of course) is "I can get application admin" and not "I get server shell access", which is still very bad but not as bad. (Source: am pentester and at work we also do code reviews.)