> When PHP was first released it was dramatically better than the alternatives for it's intended purpose.
I think that's going to depend to some degree on how you define that purpose. If it centers around having a low barrier to entry, then that's partly true, but some of the ways it achieved that involved making code written in it vulnerable to variable poisoning and SQL injection by default.
CGI didn't have register_globals, so yes on that count. I'm sure the quality of database access libraries varied, which is still a better situation than having a broken escape function built in to the language.
Well register_globals was a kind of uniquely php thing, but that's been gone for ages at this point. I generally agree though that lots of the hate for php is a bit over the top.
I think that's going to depend to some degree on how you define that purpose. If it centers around having a low barrier to entry, then that's partly true, but some of the ways it achieved that involved making code written in it vulnerable to variable poisoning and SQL injection by default.