The counter to any argument is the lived experience of anyone that developed Internet-facing apps in the 90s. Both PHP and ASP were riddled with security landm

The counter to any argument is the lived experience of anyone that developed Internet-facing apps in the 90s. Both PHP and ASP were riddled with security landmines. Developers had to be eternally vigilant, constantly making sure they were manually escaping HTML and JS safely. This is long before automatic and robust escaping such as provided by IHtmlString or modern JSON serializers. Speaking of serialisation: I wrote several, by hand, because I had to. Believe me, XML was a welcome breath of fresh air because I no longer had to figure out security-critical quoting and escaping rules by trial and error. I started in an era where there were export-grade cipher suites known to be compromised by the NSA and likely others. I worked with SAML 1.0 which is one of the worst security protocols invented by man, outdone only by SAML 2.0. I was - again — forced to implement both, manually, because “those were the times”. We are now spoiled for choice and choose poorly despite that.