PHP (the language) has long since moved past awful practices like that, and we can definitely tell people to stop doing that and use the provided safe alternati

PHP (the language) has long since moved past awful practices like that, and we can definitely tell people to stop doing that and use the provided safe alternatives instead. In fact, the PHP docs do just that. PHP is no longer to blame here. Also that number is greatly exaggerated. It's simply not true anymore, check the CVE website if you don't believe me.