Hector Martin

But most other programming languages don't teach people to make this mistake in their *official documentation*.

Don't disagree. I was referring to your latter point of "don't write PHP"

so continue to write in a language that is unsafe by default and the official docs don't help you either....why? do you also eat soup with a fork?

Show me a language that doesn't allow you to concatenate strings and use the result as a query. The docs are a problem, sure, but it's the developers and the education. It's not the language, and the language shaming was boring 10 years ago, it still is today

Culture matters. The problem is that a newbie trying to learn PHP and googling for answers is going to come across much lower quality code than a newbie learning something like Python. Even with the recent core PHP fixes, this is a problem the PHP community may never solve.

(And the docs are evidence of the problem being systemic and severe; if the docs are this bad, imagine how much worse all the random blogs are!)

You'll not get an argument from me here. I saw people writing tutorials that were susceptible to SQLi and using a deprecated interface literally days before said interface was removed when PHP 7 was released. I've seen too many of those blogs

PHP is often a victim of its own success. It flatters you. It's so easy that you make awful mistakes, not knowing what you were doing. I know; I did them. But I'd have been dangerous in any language, to be fair. I learned, and now I teach it