2: PHP, however, has types. == is wildly unpredictable
2: PHP, however, has types. == is wildly unpredictable
2. PHP is dynamically typed, like many other languages, and so you just have to know what types something can be and how they behave together. Even in a statically typed language you need to know how type conversions work. That's what the documentation is for ( http://php.net/manual/en/language.operators.comparison.php ). It's not "wildly unpredictable", it's defined and deterministic.
And not every project needs them.
PHP has been wildly successful precisely because it can fit in entirely small use cases, as well as big cases.
Someone who needs to create a dynamic footer with a "copyright $year" in it... has no need for MVC, routing, templates, version control, etc. They just don't. It's precisely because PHP has a default content-type output of 'text/html' that this sort of 'throwaway' functionality can be done with PHP and pretty much no other language. Not that other languages couldn't do this, but everyone seems to turn up their nose at this market. And yet... this is where the majority of the next generation of developers (and the current gen, and the one before) come from.
It's far too entrenched in too many operations to be easily replaced. Perl didn't get that foothold, simply because there weren't as many developers or websites back then. Well... "simply" - there are myriad reasons why Perl didn't retain its early mindshare and install lead.
To say nothing of the innumerable medium sized businesses that use these kind of "throw away" techniques to generate vast revenue. Companies that were profitable long before node or mongo entered the collective vernacular and will likely continue to be profitable long after they've faded from popularity.
Predictable !== well defined. If you have to look through a chart for equivalence, it's unpredictable to the programmer. But this is a theme for all of PHP, you can't deduct equivalence, function names and function arguments orders, you have to memorize or peruse the manual. Sure, it works, but it has drawbacks.
The requirements for a huge (often overgeneralised) enterprise application are very different from a little script for personal or small-community use. There are far more of the latter than the former, and those wanting to "get started with web programming" are going to start out with that too.
Do you think that PHP is the only language where developers look to other practices in other language communities to learn different/new/better/changing practices? Every good developer is aware of patterns and structures in other languages/platforms - I dare say it's almost the definition of a good developer. I would not regard a Ruby developer who'd only ever done Rails projects as a 'good' developer, regardless of how clean/elegant the code seems.
2. I wonder if reliance on == has ever caused any major security issues? I know there's some edge cases, but I can't remember a time == ever came back to bite me. (Yea, you can point to strpos(), but everyone knows that example and it's marked with a big red box on php.net.)
How is that a bad idea? IMHO much better by default to be outputting verbatim instead of silently changing the output. Escaping is something you should be conscious of, since you then have a better idea of where you need it and where you don't, and what type of escaping you need.
They tried to do escaping on the input by default with the magic quotes option; that didn't turn out well.
It's deterministic. It is by definition not unpredictable.