Security consultant who audits web applications. I’ve achieved many web shells over the years, the majority (80%) were in php. I’ve never seen an exploitable sq

Security consultant who audits web applications. I’ve achieved many web shells over the years, the majority (80%) were in php. I’ve never seen an exploitable sql injection vector in anything but php. When I make recommendations, they’re generally level headed somewhere between fix this, fix all instances of this, or just start from scratch. Php often receives the latter, and not purely on its language merits alone - my last php report was 150 pages due to frameworkless insanity resulting in vulnerabilities in almost every facet of the system (I literally got all top 10 owasp in a single app). I don’t know what it is about php, maybe it’s the low bar to entry or lack of unit tests, but something about the languages just results in vulnerable code.