Darn, I hate playing PHP apologist all the time. That securityfocus page has been up for some time, and there is an easy fix *in PHP* for it. It's called "checking the filename before you use it." Sure, it's a bit of a pain but it will have a more permanent fix soon. The PHP manual says this (now). If you follow the thread on securityfocus that Ovid posted, you can see how the PHP team responded.

Back to the question at hand: PHP lacks a few features that I find handy in Perl, but of course the lack will only bother you if you use these features. I am otherwise a staunch advocate of the "use what works," so if you find that PHP works for you, use it. Just don't come cryin' here when it doesn't work for you =)

• no 'use strict;' equivalent in PHP -- this would help with debugging, at the very least.
• no complex data structures in PHP, AFAIK
• PHP can use Perl-compatible regexes, but I find the implementation counterintuitive.
• while it has great DB support, PHP lacks 'placeholders' for database inserts; this makes security here a little more painful, and also potentially slower.

But PHP is still young, so this may all change.

Philosophy can be made out of anything -- or less