I write very little PHP but I work on a PHP extension written in C for a security product that integrates tightly with the language and some of the reasons I ha

I write very little PHP but I work on a PHP extension written in C for a security product that integrates tightly with the language and some of the reasons I hate it are: The Zend APIs suck, and they have non-existent or severely outdated docs. For example, one of PHP's main internal data structure, zend_hash, is a weird hash table with a string / int union key type and is awkward to access or iterate over. Memory issues. I've had to debug segfaults caused by memory bugs in the language and core libs more than once. For example I hit an uninitialized read error in mbstring, it's been in their bug tracker since 5.x and never fixed. I understand the normal way to deal with memory errors in PHP is to shrug it off because processes are short-lived but if you are security-conscious it is concerning. Compared to that, working on similar integrations for Python, Java, Node.js, the number of times I've hit such bugs is exactly zero. PHP just seems to have lower quality and worse design overall. EDIT: CVE database agrees with my assessment, so many more memory issues in PHP: PHP: https://www.cvedetails.com/product/128/PHP-PHP.html?vendor_id=74 https://www.cvedetails.com/product/128/PHP-PHP.html?vendor_i... Python: https://www.cvedetails.com/product/18230/Python-Python.html?vendor_id=10210 https://www.cvedetails.com/product/18230/Python-Python.html?... Java: https://www.cvedetails.com/product/19117/Oracle-JRE.html?vendor_id=93 https://www.cvedetails.com/product/19117/Oracle-JRE.html?ven...