4 ms·

The fact it's been written in PHP is meaningless. As for "designed without security as a goal", I think you'll find that's true for most web apps.