Hacker ApprovedDepartments

PHP

Ranked 11 of 163 programming languages by recommenders

A long-lived web language that has improved a lot, with easy deployment, few dependencies and code that keeps working; critics cite recurring security vulnerabilities and breaking changes.

A long-lived web language that has improved a lot, with easy deployment, few dependencies and code that keeps working; critics cite recurring security vulnerabilities and breaking changes.

590 people gave an opinion

recommend it
295
criticize it
295
approval share
50%
Each figure is 5 people. RecommendsCriticizes

Recommended in 12 of 13 months

  1. November 2025: recommended
  2. December 2025: recommended
  3. January 2026: recommended
  4. February 2026: recommended
  5. March 2026: recommended
  6. April 2026: recommended
  7. May 2026: recommended
  8. June 2026: recommended
  9. July 2026: recommended
  10. August 2026: recommended
  11. September 2026: recommended
  12. October 2026: recommended
  13. November 2026: not recommended (month in progress)

Owned for 20 years

Median of the 28 owners who said how long they have had it.

Each square is one year.

Why it doesn’t carry the badge

  • 295 people recommend itNeeds 10 or more, met.
  • 1 recommender for every criticNeeds 2 to 1 or better, not met.
  • Recommended in 12 of 13 monthsNeeds 4 or more, met.

The same three rules apply to every product, and the badge can’t be bought. How the badge works

What people say about it

The reasons people give, with the number of comments that give each one. Open a reason to read what they said.

Why people recommend it

Each mark is one comment

  • Modern versions greatly improved

    “I know I used to have the impression of PHP as a messy language because I last worked with PHP4. It's come a long way since then”

    Comment from 23 May 2026 in “PHP's Oddities”

    “The amount of hard work that the PHP community has done to advance and keep their language relevant is impressive and admirable”

    Comment from 25 Aug 2026 in “Python's pre-declared constants are kinda weird”

    “the syntax has always been awful and is even more degraded now, but the ecosystem is globally in a much better place”

    Comment from 2 Jan 2026 in “Matz 2/2: The trajectory of Ruby's growth, Open-Source Software today etc.”
  • Simple to deploy web apps

    “far less deployment friction and better aesthetics than Perl did on machines where you didn't have admin access”

    Comment from 7 Dec 2025 in “Perl's decline was cultural”

    “You can still build web apps using more basic technologies like PHP, MySQL/Postgres, and just using vanilla JS.”

    Comment from 5 Jan 2026 in “Web development is fun again”

    “It was easy to deploy PHP web apps since they could be readily dropped in your htdocs or public_html directory”

    Comment from 19 Nov 2025 in “What Killed Perl?”
  • Stable, no stack churn

    “It worked great and we hadn't encountered business problems that couldn't be fairly easily solved within the ecosystem.”

    Comment from 4 Nov 2025 in “Why engineers can't be rational about programming languages”

    “PHP is a reasonable choice if you care about writing something that will still work out of the box 10 years from now.”

    Comment from 20 Nov 2025 in “PHP 8.5”

    “One of the best features of PHP is that you don't have to learn and unlearn new tech stacks every few years.”

    Comment from 5 May 2026 in “Why I Created phpc.tv”
  • Request-per-process model avoids bugs

    “Entire classes of bugs that are common in Java, C/C++, .NET and other true multi-threaded environments simply cannot exist in the PHP world at all”

    Comment from 16 Apr 2026 in “PHP 8.6 Closure Optimizations”

    “the model of a single thread responding to a request then discarding everything in PHP/Hack is virtually ideal”

    Comment from 8 Jan 2026 in “Kernel bugs hide for 2 years on average. Some hide for 20”

What people warn about

Each mark is one comment

  • Recurring security vulnerabilities

    “I like PHP and I use it everyday. What concerns me about incidents like this isn't just the vuln itself, but how much access a compromised PHP process can have to the rest of the system.”

    Comment from 21 Oct 2026 in “Security advisory: Critical remote code execution vulnerabilities, update now”

    “But it also has become a liability when they are all now scared that the server can be easily taken over.”

    Comment from 21 Oct 2026 in “Security advisory: Critical remote code execution vulnerabilities, update now”

    “It's almost common knowledge that any PHP site can be hacked by intelligence agencies or state actors due to either errors in the runtime or the solutions themselves.”

    Comment from 23 Oct 2026 in “PHP 8.2.35”
  • Breaks backward compatibility

    “The PHP team keeps breaking backward compatibility and trying to introduce new features instead of focusing on fixing bugs and hardening the compiler.”

    Comment from 21 Oct 2026 in “PHP 8.2.35”

    “now they overcorrected with types, annotations and breaking backwards compatibility with every release so that no old code base can remain intact”

    Comment from 20 Nov 2025 in “PHP 8.5”

    “Instead of creating better software they have always tried to add features with no consideration of backward compatibility.”

    Comment from 22 Oct 2026 in “Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure”
  • New releases add little value

    “It's a mess and more bug prone than just nesting the functions.”

    Comment from 20 Nov 2025 in “PHP 8.5”

    “The new array_first() and array_last() functions are nice, everything else is either reimplantation of existing features”

    Comment from 20 Nov 2025 in “PHP 8.5”
  • Historic footguns and messy design

    “core ergonomics is significantly lagging behind most other backend languages despite improvements in some areas”

    Comment from 20 Nov 2025 in “PHP 8.5”

    “I simply cannot bring myself to attempt it again. I once had to rewrite large chunks of a site because it simply couldn't deal with the fact that a string had an apostrophe in it.”

    Comment from 25 Aug 2026 in “Python's pre-declared constants are kinda weird”

    “PHP had plenty of magic and footguns, magic_quotes, register_globals, mysql_real_escape_string, errors with stacktraces leaking into the HTML output by default”

    Comment from 20 Apr 2026 in “Vercel April 2026 security incident”

Other programming languages people recommend

The four most recommended other programming languages, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.

PHP compared with 4 alternatives
ProductRecommendCriticizeApprovalMonthsOwnedBadge
Rust2,03997368%134 yrs118 ownersApproved
Go1,25465166%135.9 yrs63 owners—
Python1,06782157%1218 yrs64 owners—
Zig74344962%121 yr27 owners—
PHPThis page29529550%1220 yrs28 owners—
See all 163 programming languages, ranked

What people said

40 of the 776 comments that mention it, newest first. Each links to the original comment.

“PHP, and ultimately Ruby, Python, Perl, and Node.js, will all eventually be proven to be inappropriate for web development.”

MixedComment from 25 Oct 2026 in “PHP Foundation 'under-funded' with one full-time staff member, director says”

“It's almost common knowledge that any PHP site can be hacked by intelligence agencies or state actors due to either errors in the runtime or the solutions themselves.”

CriticizesComment from 23 Oct 2026 in “PHP 8.2.35”

“Instead of creating better software they have always tried to add features with no consideration of backward compatibility.”

CriticizesComment from 22 Oct 2026 in “Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure”

“The fact that OOM conditions are an enduring source of exploitable vulnerabilities in PHP really should give everyone a pause.”

CriticizesComment from 21 Oct 2026 in “PHP 8.2.35”

“2x PHP is still cheaper than Python and many other languages which most people would consider fine for your typical webapp.”

RecommendsComment from 21 Oct 2026 in “PHP 8.2.35”

“The PHP team keeps breaking backward compatibility and trying to introduce new features instead of focusing on fixing bugs and hardening the compiler.”

CriticizesComment from 21 Oct 2026 in “PHP 8.2.35”

“But it also has become a liability when they are all now scared that the server can be easily taken over.”

MixedComment from 21 Oct 2026 in “Security advisory: Critical remote code execution vulnerabilities, update now”

“I like PHP and I use it everyday. What concerns me about incidents like this isn't just the vuln itself, but how much access a compromised PHP process can have to the rest of the system.”

MixedComment from 21 Oct 2026 in “Security advisory: Critical remote code execution vulnerabilities, update now”

“yes, there are many objective issues with it even today, but it also has many strengths beyond just having existed for a long time”

MixedComment from 4 Oct 2026 in “Why don't more developers “use the platform”?”

“I simply cannot bring myself to attempt it again. I once had to rewrite large chunks of a site because it simply couldn't deal with the fact that a string had an apostrophe in it.”

CriticizesComment from 25 Aug 2026 in “Python's pre-declared constants are kinda weird”

“The amount of hard work that the PHP community has done to advance and keep their language relevant is impressive and admirable”

RecommendsComment from 25 Aug 2026 in “Python's pre-declared constants are kinda weird”

“PHP can run the same code fully dynamically typed or with very strict type annotations, depending on your requirements.”

RecommendsComment from 20 Jul 2026 in “Exploit brokers pay $500k for WordPress RCEs. I found one with GPT5.6 and $25”

“php itself is not a bad language, i use it too if it is appropriate, but it also has improved over the decades”

RecommendsComment from 14 Jul 2026 in “Scarf has moved away from Haskell”

“Not only are the old 90's languages like Java, PHP, and JavaScript now actually doing things correctly.”

MixedComment from 30 Jun 2026 in “Ante: A New Way to Blend Borrow Checking and Reference Counting”

“I know I used to have the impression of PHP as a messy language because I last worked with PHP4. It's come a long way since then”

MixedComment from 23 May 2026 in “PHP's Oddities”

“Modern PHP is great. Many powerful language features, excellent performance, great community and package ecosystem”

RecommendsComment from 23 May 2026 in “PHP's Oddities”

“I've never had a situation where a security flaw in PHP itself forced me to scramble to patch something before it got hacked.”

RecommendsComment from 9 May 2026 in “CPanel's Black Week: 3 New Vulnerabilities Patched After Attack on 44k Servers”

“One of the best features of PHP is that you don't have to learn and unlearn new tech stacks every few years.”

RecommendsComment from 5 May 2026 in “Why I Created phpc.tv”

“PHP had plenty of magic and footguns, magic_quotes, register_globals, mysql_real_escape_string, errors with stacktraces leaking into the HTML output by default”

CriticizesComment from 20 Apr 2026 in “Vercel April 2026 security incident”

“Entire classes of bugs that are common in Java, C/C++, .NET and other true multi-threaded environments simply cannot exist in the PHP world at all”

RecommendsComment from 16 Apr 2026 in “PHP 8.6 Closure Optimizations”

“PHP, Ruby and VB have more successful code written in them than all current academic or disproportionately hyped languages will ever have combined.”

RecommendsComment from 25 Mar 2026 in “Thoughts on Slowing the Fuck Down”

“PHP gives you more opportunities than some other languages, especially with older PHP standard library functions.”

MixedComment from 5 Mar 2026 in “Wikipedia in read-only mode following mass admin account compromise”

“PHP is not slow by default or meant to run persistently (low memory use is nice), but it still gets a lot of justified criticism.”

MixedComment from 25 Feb 2026 in “100M-Row Challenge with PHP”

“the model of a single thread responding to a request then discarding everything in PHP/Hack is virtually ideal”

RecommendsComment from 8 Jan 2026 in “Kernel bugs hide for 2 years on average. Some hide for 20”

“You can still build web apps using more basic technologies like PHP, MySQL/Postgres, and just using vanilla JS.”

RecommendsComment from 5 Jan 2026 in “Web development is fun again”

“the syntax has always been awful and is even more degraded now, but the ecosystem is globally in a much better place”

MixedComment from 2 Jan 2026 in “Matz 2/2: The trajectory of Ruby's growth, Open-Source Software today etc.”

“PHP was revolutionary at the time for how easy and straightforward it was to do simple web programming”

RecommendsComment from 22 Dec 2025 in “Ask HN: Why Did Python Win?”

“far less deployment friction and better aesthetics than Perl did on machines where you didn't have admin access”

RecommendsComment from 7 Dec 2025 in “Perl's decline was cultural”

“primarily because it still allows us to create a platform without bringing in over 100 dependencies just to render one page”

RecommendsComment from 24 Nov 2025 in “Shai-Hulud Returns: Over 300 NPM Packages Infected”

“I think PHP 8 is easy to understand if you write it from scratch, you just have to learn doing things the right way”

RecommendsComment from 20 Nov 2025 in “PHP 8.5”

“The new array_first() and array_last() functions are nice, everything else is either reimplantation of existing features”

MixedComment from 20 Nov 2025 in “PHP 8.5”

“core ergonomics is significantly lagging behind most other backend languages despite improvements in some areas”

MixedComment from 20 Nov 2025 in “PHP 8.5”

“now they overcorrected with types, annotations and breaking backwards compatibility with every release so that no old code base can remain intact”

CriticizesComment from 20 Nov 2025 in “PHP 8.5”

“PHP is a reasonable choice if you care about writing something that will still work out of the box 10 years from now.”

RecommendsComment from 20 Nov 2025 in “PHP 8.5”

“PHP won because it was worse, you didn't have the power or choice Perl provided, but it was more than good enough”

MixedComment from 20 Nov 2025 in “What Killed Perl?”

“everything else is either reimplantation of existing features or "features"which will make maintainability more difficult”

MixedComment from 20 Nov 2025 in “PHP 8.5”

“It's a mess and more bug prone than just nesting the functions.”

CriticizesComment from 20 Nov 2025 in “PHP 8.5”

“It was easy to deploy PHP web apps since they could be readily dropped in your htdocs or public_html directory”

RecommendsComment from 19 Nov 2025 in “What Killed Perl?”

“Modern PHP is a strongly typed language, still dynamically typed, but in a way that feels more like static typing.”

RecommendsComment from 9 Nov 2025 in “Opencloud – An alternative to Nextcloud written in Go”

“It worked great and we hadn't encountered business problems that couldn't be fairly easily solved within the ecosystem.”

RecommendsComment from 4 Nov 2025 in “Why engineers can't be rational about programming languages”

Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.