There's a lot of talk that PHP is "inherently insecure" and "great if you want your site to get hacked". I've never used PHP, so I can't make an educated opinion myself, but I am wondering why this is said so often. And if it really is "inherently insecure", how come so many HS use them (especially ones engaging in the trading of less than legal items, eh)?
I don't really understand the suggestion that it's easy to hack or something. I would think possibly less so, or at least with PHP the code is stored server side rather than in the browser. Someone could potentially have an exploit for a particular PHP version, but that is likely to affect more than just a hidden service. If in doubt, maybe a static site is more secure, although likely less interesting.