I hate PHP, but that article is so old and outdated now that it's meaningless in this context. PHP is a completely different language with far more strict typing to opt into and more consistent stdlib APIs.
Most of what it says is still true today. Stdlib did add new functions and flags (which only add to the inconsistency) but most the ones the article mentions still have the same behavior today. Plus new issues as well.
Something I found the other day, typed parameters won't error if you change the type, even with strict_types turned on:
This is expected behavior and works like a charm. The type of a variable can always change at any time. The argument hint is designed to make sure you’re given the expected type. Not that the variable will only hold that type.
PHP reminds me of my socially awkward uncle who is endearing and means well and caused many cringes & me and my sister to laugh with his faux pas.
I love reading articles about its bugs. The Mr Bean of programming languages.
We need PHP just as the film industry needs its gaffer tape. It's just that we have a very good standard of Gaffer tape (357 or "perl" in programming). It is kinda expensive though in dollars or cognitive cycles. So sometimes we use the inferior stuff that is not the standard 357. But then, we find, after the film bumps out - it caused you to rip the paint off the floor in the venue the film hired and not get your $10,000k deposit back.
Honestly we don't need PHP, which we've proven because basically no one uses it for anything other than WordPress, Drupal, and (internally) Facebook now. Facebook may even have finished porting all their PHP to Hack and other languages.
There will be a few HN commenters who say they still use Laravel or something, but in reality it's a tiny percentage of people using it now.
OP’s link disagrees. A critical vulnerability being called »not a bug RTFM« is the same cultural and engineering level of »string length as hash function what’s the problem«.
The response is wrong though. The RFC for this function which someone quoted further down in the bug report clearly stated that it should return false even if you feed it a garbage hash.
