Classic ASP is not a thing anymore. There's no security issue with pasting scripts into text boxes unless the server-side code allows for that to happen. It's

Classic ASP is not a thing anymore. There's no security issue with pasting scripts into text boxes unless the server-side code allows for that to happen. It's not a fundamental flaw of ASP/PHP in other words, just bad programming. Same with SQL injections and other security issues -- every back-end language used for web development has mitigations and best practices to prevent those issues, including PHP. There's nothing wrong with writing a web site with PHP using the HTTP request/response model. PHP is mature, stable, fast, and well-supported at versions 7 and 8. It's easy to deploy and has everything you need out of the box. There's nothing you can do with Node.js that you can't do with PHP, unless you're interested in dealing with npm and tangled dependencies and modules of questionable utility and security, in which case choose Node. Writing a so-called "modern" web app using front-end frameworks such as React and Angular is a very different thing compared to doing most of the work on the back-end (server) in PHP or Node. They aren't really comparable, two very different approaches. The advantage (if you can call it that) of writing the code on the client is users see spinners waiting for content to load rather than reloading the whole page. Which approach you take depends on the application, the end users, and the requirements. There's no single answer to "Which set of tools should I use?" PHP works well for building web sites because it was designed to do that. It has some warts and ugliness, like every language/tool that people actually use, but nothing you, I, and hundreds of thousands of other developers can't live with.