I'd sooner cancel a contract before installing PMA on any of my servers. And judging from the scans I see in the logs, where script kiddies are trying to find that PMA instance, I'd say PMA is still a frigging mess.

Just remembering how often I read PMA had SQL injection issues gives me shivers. It's a DB management application and they still didn't get the DB part right.

Not only the app itself... but the developers practice:

a) I can write here.
b) I download phpmyadmin where I can write.
c) I do not talk to sysadmin, because she makes me think.
d) I go to the login form, using plain HTTP and database credentials, probably from a wifi.
e) I let the downloaded version, running for year, without upgrades.

So if you let people write on your servers, best practice as sysadmin is, like kiddies, to run audit tools over your writable server.

Greetings

I should probably say my servers don't run PHP at all; to avoid issues with applications which have traditionally been problematic.

(Which is software like wordpress, phpmyadmin, etc.)

I don't use PMA but for those who want to use it the best practice is make PMA listen to localhost only and then use ssh tunneling to connect to it.

I apply the same prejudice to ANY PHP application.

I've just seen too many PHP apps that are pretty and fancy and powerful on the outside but an ugly mess on the inside. E.g. I've seen a pretty webmail interface keep all passwords in plaintext forever in a "session" table on a SQL server...
I've seen "password protection" on blog posts being trivial to bypass. Etc.

The only language where average code quality is worse than in PHP probably is JavaScript...

Well sendmail;s probably still a mess, not that much any
more (except certain packaging of it), but the insecure
part hasn't been true for a few years. (Actually, the
other way round.)

I sort of agree on the rest, though