Heh, sorry, this made me chuckle. I'm sorry you're right, but ya know, it's a GNU project, so there's always room to contribute. :)

Instead of being written in Guile Scheme.

I rummaged around and found a lot of the old, deprecated mysql_functions (with error suppression turned off, even,) raw queries and no prepared statements anywhere. They may be there, but this codebase is frustrating to roam around in. I did find a few comments warning of possible SQL injection problems if parameters aren't sanitized - which should not be a thing in modern PHP.

I support the project wholeheartedly but I can't help but despair at the amount of NIH syndrome and archaic patterns I'm seeing. Unsurprising given how old some of the code seems but be, but still... code like this doesn't inspire confidence in the long-term stability of the project.

I can't defend any code quality (and I'm certainly not associated with the project, I merely host my own/private network)...but i suppose php was chosen as the stack for (hopefully) more universal adoption. Most low-cost/budget (old school) web hosting companies support php out of the box...and the intent is for folks to host their own network instead of hopping on others, etc.