PHP, since version 7.0, has been a much improved language since when many people started hating on it. They have been consistently moving the spec forward and making improvements. It's not perfect, but no language really is after all. It is really nice just seeing issues that have been around for a long time being addressed and fixed.
I have to confess that I have a lot of prejudice against PHP after having to work with it at the time of PHP3 and 4. It seemed like even worse than Perl in the sense of how many things were just bolted on it as a way that the developers could claim "yeah, you can do that with PHP". After having a blog running wordpress hacked twice by mere virtue of being online, I dismissed it for good. I keep hearing about how the…
Modern cryptography is baked in since 7.2.
https://libsodium.gitbook.io/doc/bindings_for_other_language...
Most of the people who shit on PHP have a lot of love for other languages. A survey of the cryptography features the "favored" languages offer will almost certainly fall into two camps:
1. "We wrap OpenSSL"
2. "Go compile it yourself" (i.e. there is nothing baked in)
There's a lot of badness with OpenSSL's API design, especially with asymmetric cryptography. For a fun exercise in these languages, try encrypting with RSA with OAEP padding, but without using SHA1 as your hash function.
For completeness, PHP is one of the languages that wraps OpenSSL too! But it also wraps libsodium, and the community has been moving towards libsodium (unless they need something from OpenSSL for the sake of backwards compatibility) since early in the 7.x series.
If you're going to provide cryptography features in your language, but you aren't shipping modern cryptography in your standard library, you're underperforming what PHP has offered for years at this point. The easiest way to meet the standard that PHP 7.2+ establishes is to add libsodium to your language's standard library.
(There are salient arguments for "why even provide a cryptography feature as part of the language at all?" but most of the languages that see real world deployment are already doing that.)