People who say PHP is insecure are uninformed, and I'll happily have a healthy debate in the replies. The reputation comes from the 90s and early 2000s, when PHP powered most of the web and security was an afterthought everywhere. People who cut their teeth hacking those sites still feel the flinch when they see PHP. Modern PHP ships with secure primitives out of the box, like prepared statements via PDO and built-in password hashing. Frameworks like Laravel go further and escape output by default. And these days you often can't tell a site is running PHP at all, most frameworks route away from the .php extension now. Before you throw a jab at a language, framework, or any technology, try testing it first. Then let's have a wholesome argument.