There’s to many PHP legacy tutorials out there on the internet, every day you see people who are new to PHP ask for help on script for they are learning PHP for the first time and found this tutorial on the net or it’s obvious they had for I spot is msyql instead of mysqli or PDO. Then you explain to them that mysql is obsolete and that you should choose one of the two alternatives. You get one of two responses.
First response - “Oh I didn’t know that, Thanks for pointing that out”
Second response (This one irks me to no end) - “Oh I know that, but I just want to get my script to run. I’ll go back later on and change it when I have the time”.
I see that second reponse a lot and sometimes you get even a worse response than that, something like “I don’t care, I just want to get my script to work”. The later group of people is a lost cause and the ones who say they will go back when they have the time, I doubt that they ever will. It is not just that the make for PHP insecurities, for it’s other aspects of programming in PHP that make it insecure. A lot of people have this way of thinking - “If it is on the internet, it must be true” mentality.
I still remember what it was like when I was new to PHP and spent long hours on a script only to ask help on it to get the reply - “You best to throw that code in the trash and start over for that has more security holes in it than Swiss cheese does”. The first inclination is to get defensive about it, but after a cooling of period you realize that the person was only trying to steer you in the right direction. It’s better to get a better grasp of PHP by doing it the right way the first time and I have learn before tackling something new in PHP to ask if I starting off the right way. Thus, hopefully avoiding spending needless hours on PHP code that is a pile of junk. That is my opinion why PHP can have a bad reputation, for there still a lot of legacy code still out there on the internet masquerading as helpful tutorials.