Comment by brokenparser

Doesn't make sense because Squirrelmail is also written in PHP and it's pretty solid. The next version will use HTTP-only cookies to further harden against attacks.