Earlier quoted context omitted.
I agree with more or less with what you said but a downside of PHP is not security vulnerabilities, that's really just a myth. I can't remember the last vulnerability which could be directly attributed to PHP as a language. Sure, there are plenty of apps containing holes but those are not caused by PHP but by not coding correctly, eg not checking input making SQL injections possible etc. Which might confirm what you…
Languages are like tools: buying a the best set you can afford is the best possible start to a project. PHP doesn't cause SQL injection flaws, but it doesn't make it any easier. How many escape functions are there ? Shall we count them ? ---------- mysql_escape_string() - Escapes a string for use in a mysql_query mysql_real_escape_string() - Escapes special characters in a string for use in a SQL statement mysqli_rea…
It basically argues that in PHP there's often an easy, insecure way to do something and a verbose, secure way to do it. With regards to SQL injection, Java is the same way; prepared statements are much more verbose and annoying than string concatenation.