PHP
Ranked 11 of 163 programming languages by recommenders
A long-lived web language that has improved a lot, with easy deployment, few dependencies and code that keeps working; critics cite recurring security vulnerabilities and breaking changes.
A long-lived web language that has improved a lot, with easy deployment, few dependencies and code that keeps working; critics cite recurring security vulnerabilities and breaking changes.
590 people gave an opinion
- recommend it
- 295
- criticize it
- 295
- approval share
- 50%
Recommended in 12 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Owned for 20 years
Median of the 28 owners who said how long they have had it.
Each square is one year.
Why it doesn’t carry the badge
- 295 people recommend itNeeds 10 or more, met.
- 1 recommender for every criticNeeds 2 to 1 or better, not met.
- Recommended in 12 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Modern versions greatly improved
“I know I used to have the impression of PHP as a messy language because I last worked with PHP4. It's come a long way since then”
Comment from 23 May 2026 in “PHP's Oddities” “The amount of hard work that the PHP community has done to advance and keep their language relevant is impressive and admirable”
Comment from 25 Aug 2026 in “Python's pre-declared constants are kinda weird” “the syntax has always been awful and is even more degraded now, but the ecosystem is globally in a much better place”
Comment from 2 Jan 2026 in “Matz 2/2: The trajectory of Ruby's growth, Open-Source Software today etc.” - Comment from 23 May 2026 in “PHP's Oddities”
- Comment from 14 Jul 2026 in “Scarf has moved away from Haskell”
- Comment from 30 Jun 2026 in “Ante: A New Way to Blend Borrow Checking and Reference Counting”
Simple to deploy web apps
“far less deployment friction and better aesthetics than Perl did on machines where you didn't have admin access”
Comment from 7 Dec 2025 in “Perl's decline was cultural” “You can still build web apps using more basic technologies like PHP, MySQL/Postgres, and just using vanilla JS.”
Comment from 5 Jan 2026 in “Web development is fun again” “It was easy to deploy PHP web apps since they could be readily dropped in your htdocs or public_html directory”
Comment from 19 Nov 2025 in “What Killed Perl?” - Comment from 22 Dec 2025 in “Ask HN: Why Did Python Win?”
Stable, no stack churn
“It worked great and we hadn't encountered business problems that couldn't be fairly easily solved within the ecosystem.”
Comment from 4 Nov 2025 in “Why engineers can't be rational about programming languages” “PHP is a reasonable choice if you care about writing something that will still work out of the box 10 years from now.”
Comment from 20 Nov 2025 in “PHP 8.5” “One of the best features of PHP is that you don't have to learn and unlearn new tech stacks every few years.”
Comment from 5 May 2026 in “Why I Created phpc.tv” Request-per-process model avoids bugs
“Entire classes of bugs that are common in Java, C/C++, .NET and other true multi-threaded environments simply cannot exist in the PHP world at all”
Comment from 16 Apr 2026 in “PHP 8.6 Closure Optimizations” “the model of a single thread responding to a request then discarding everything in PHP/Hack is virtually ideal”
Comment from 8 Jan 2026 in “Kernel bugs hide for 2 years on average. Some hide for 20”
What people warn about
Each mark is one comment
Recurring security vulnerabilities
“I like PHP and I use it everyday. What concerns me about incidents like this isn't just the vuln itself, but how much access a compromised PHP process can have to the rest of the system.”
Comment from 21 Oct 2026 in “Security advisory: Critical remote code execution vulnerabilities, update now” “But it also has become a liability when they are all now scared that the server can be easily taken over.”
Comment from 21 Oct 2026 in “Security advisory: Critical remote code execution vulnerabilities, update now” “It's almost common knowledge that any PHP site can be hacked by intelligence agencies or state actors due to either errors in the runtime or the solutions themselves.”
Comment from 23 Oct 2026 in “PHP 8.2.35” - Comment from 21 Oct 2026 in “PHP 8.2.35”
Breaks backward compatibility
“The PHP team keeps breaking backward compatibility and trying to introduce new features instead of focusing on fixing bugs and hardening the compiler.”
Comment from 21 Oct 2026 in “PHP 8.2.35” “now they overcorrected with types, annotations and breaking backwards compatibility with every release so that no old code base can remain intact”
Comment from 20 Nov 2025 in “PHP 8.5” “Instead of creating better software they have always tried to add features with no consideration of backward compatibility.”
Comment from 22 Oct 2026 in “Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure” New releases add little value
“It's a mess and more bug prone than just nesting the functions.”
Comment from 20 Nov 2025 in “PHP 8.5” “The new array_first() and array_last() functions are nice, everything else is either reimplantation of existing features”
Comment from 20 Nov 2025 in “PHP 8.5” Historic footguns and messy design
“core ergonomics is significantly lagging behind most other backend languages despite improvements in some areas”
Comment from 20 Nov 2025 in “PHP 8.5” “I simply cannot bring myself to attempt it again. I once had to rewrite large chunks of a site because it simply couldn't deal with the fact that a string had an apostrophe in it.”
Comment from 25 Aug 2026 in “Python's pre-declared constants are kinda weird” “PHP had plenty of magic and footguns, magic_quotes, register_globals, mysql_real_escape_string, errors with stacktraces leaking into the HTML output by default”
Comment from 20 Apr 2026 in “Vercel April 2026 security incident”
Other programming languages people recommend
The four most recommended other programming languages, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
See all 163 programming languages, rankedWhat people said
40 of the 776 comments that mention it, newest first. Each links to the original comment.
“PHP, and ultimately Ruby, Python, Perl, and Node.js, will all eventually be proven to be inappropriate for web development.”
“It's almost common knowledge that any PHP site can be hacked by intelligence agencies or state actors due to either errors in the runtime or the solutions themselves.”
“Instead of creating better software they have always tried to add features with no consideration of backward compatibility.”
“The fact that OOM conditions are an enduring source of exploitable vulnerabilities in PHP really should give everyone a pause.”
“2x PHP is still cheaper than Python and many other languages which most people would consider fine for your typical webapp.”
“The PHP team keeps breaking backward compatibility and trying to introduce new features instead of focusing on fixing bugs and hardening the compiler.”
“But it also has become a liability when they are all now scared that the server can be easily taken over.”
“I like PHP and I use it everyday. What concerns me about incidents like this isn't just the vuln itself, but how much access a compromised PHP process can have to the rest of the system.”
“yes, there are many objective issues with it even today, but it also has many strengths beyond just having existed for a long time”
“I simply cannot bring myself to attempt it again. I once had to rewrite large chunks of a site because it simply couldn't deal with the fact that a string had an apostrophe in it.”
“The amount of hard work that the PHP community has done to advance and keep their language relevant is impressive and admirable”
“PHP can run the same code fully dynamically typed or with very strict type annotations, depending on your requirements.”
“php itself is not a bad language, i use it too if it is appropriate, but it also has improved over the decades”
“Not only are the old 90's languages like Java, PHP, and JavaScript now actually doing things correctly.”
“I know I used to have the impression of PHP as a messy language because I last worked with PHP4. It's come a long way since then”
“Modern PHP is great. Many powerful language features, excellent performance, great community and package ecosystem”
“I've never had a situation where a security flaw in PHP itself forced me to scramble to patch something before it got hacked.”
“One of the best features of PHP is that you don't have to learn and unlearn new tech stacks every few years.”
“PHP had plenty of magic and footguns, magic_quotes, register_globals, mysql_real_escape_string, errors with stacktraces leaking into the HTML output by default”
“Entire classes of bugs that are common in Java, C/C++, .NET and other true multi-threaded environments simply cannot exist in the PHP world at all”
“PHP, Ruby and VB have more successful code written in them than all current academic or disproportionately hyped languages will ever have combined.”
“PHP gives you more opportunities than some other languages, especially with older PHP standard library functions.”
“PHP is not slow by default or meant to run persistently (low memory use is nice), but it still gets a lot of justified criticism.”
“the model of a single thread responding to a request then discarding everything in PHP/Hack is virtually ideal”
“You can still build web apps using more basic technologies like PHP, MySQL/Postgres, and just using vanilla JS.”
“the syntax has always been awful and is even more degraded now, but the ecosystem is globally in a much better place”
“PHP was revolutionary at the time for how easy and straightforward it was to do simple web programming”
“far less deployment friction and better aesthetics than Perl did on machines where you didn't have admin access”
“primarily because it still allows us to create a platform without bringing in over 100 dependencies just to render one page”
“I think PHP 8 is easy to understand if you write it from scratch, you just have to learn doing things the right way”
“The new array_first() and array_last() functions are nice, everything else is either reimplantation of existing features”
“core ergonomics is significantly lagging behind most other backend languages despite improvements in some areas”
“now they overcorrected with types, annotations and breaking backwards compatibility with every release so that no old code base can remain intact”
“PHP is a reasonable choice if you care about writing something that will still work out of the box 10 years from now.”
“PHP won because it was worse, you didn't have the power or choice Perl provided, but it was more than good enough”
“everything else is either reimplantation of existing features or "features"which will make maintainability more difficult”
“It's a mess and more bug prone than just nesting the functions.”
“It was easy to deploy PHP web apps since they could be readily dropped in your htdocs or public_html directory”
“Modern PHP is a strongly typed language, still dynamically typed, but in a way that feels more like static typing.”
“It worked great and we hadn't encountered business problems that couldn't be fairly easily solved within the ecosystem.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.