For point 3b, now that I think was a mistake what they did with the RC versions. Having a form that supposedly protects the admin part at the application level? all it does is to give the false impression to the merchant. The way it should be done was to display a message that the admin part must be protected from the host's cpanel, all the time till the merchant switches it off. Lots of osC sites go through problems everyday because of the false impression their admin is secure.

Also I want to comment for some people who argue about the tables used in the osCommerce vs divs (CSS) that is getting popular. If you do not know how to use the divs the advantages are insignificant while the effort to support the various browsers is significant. How many times I see some of these "modern" templates to look like mickey mouse on one browser or another.

Try a 3 column layout each column with different background color and then align them vertically so they all have the same height (eg: If Gary wanted to change the width of one if the side columns in his blog he would had to create another background image – a bad approach if you ask me). See how "simple" it is and compare it using a table 1 row, 3 cells. Add at the top the SEO requirements and what takes you couple of minutes to do with tables it takes x100 with divs. It is true you can use the divs to save space decrease load times and improve SEO but how many stores out there do that correctly? Not just using some divs.

Talking about SEO, why is it so may sites having hundreds and hundreds of jscript code and css inside the pages before reaching the first link or sentence of the page content. And a search engine never knows what the meaning of the page is. It's all down to implementation rather than the age of a framework.

That's because these sellers use designers who have zero idea about osCommerce. Professional Template sellers who know osCommerce inside out will sell you only the modified files and give proper support if things go wrong.

"The only thing I explained is how insecure it is to use register_globals…and the fact that oscommerce still relies on it."

osCommerce does not rely on register globals being on.

Have you ever looked at the mysql query log for an oscommerce site?

On the category and product pages, at least 5 different calls are made to the exact same data. The worst part about it is the fact that you have to hunt around to 5 or 6 different files to find out where they are being called.

On my own customized sites, I was able to reduce almost all of them down to 1, which helps if you have tons of traffic coming to your site.

No, I never "gave up". I have been using oscommerce for at least 5 years, including the latest version. I am a developer, so the fact that it works is just as important as how well the code fits together, because I need to write customized mods for it.