It’s not about practice versus theory. It’s about the actual costs of writing fast PHP versus the cost of writing good secure code (which is also possible in va

It’s not about practice versus theory. It’s about the actual costs of writing fast PHP versus the cost of writing good secure code (which is also possible in variants of PHP). Terrible code in PHP is possible, therefore likely. I say this having spent over a decade writing it and half of that time fixing OWASP bugs created in it. The incumbents hate it because their vendors use it and everyone is worse off for having their vendors use it. And Facebook did use PHP in the first few years, but they quickly started compiling it (HipHop) and later converted their code based to use a different strongly-typed language based on PHP (Hack). They stopped using PHP because it is a starter language.