I still remember PHP3... PHP5 was not "horrible in almost any metric", and it was much easier to write secure code with PHP5, which is why "websites running old PHP code are so seldom hacked".
PHP expects programmers not to do stupid things... I guess that is too much to ask in the modern era where "programmers" do not want to have to actually program anything, they instead want make a function statement, then have AI fill in the rest for them, or use a Low Code or "RAD" framework to abstract away all the actual programming so they can do the "fun design stuff" ...
I use PHP for my day job, but the one thing I miss most is compile-time (type) errors. PHP just goes until it can’t go any more. I prefer languages that tell me that I forgot something somewhere, or that a name or signature change broke something somewhere I hadn’t thought about.
PHP expects programmers not to do stupid things... I guess that is too much to ask in the modern era where "programmers" do not want to have to actually program anything, they instead want make a function statement, then have AI fill in the rest for them, or use a Low Code or "RAD" framework to abstract away all the actual programming so they can do the "fun design stuff" ...