> The community is always quick to learn from
    > its mistakes however

There was a tutorials site on the front page of HN recently. It has a few PHP tutorials.

http://codular.com/implementing-pagination

    $sql = 'SELECT * FROM `articles` LIMIT ' . $startArticle . ', ' . $articlesPerPage;

http://codular.com/part-2-rating-system

    INSERT INTO `ratings`
    (`rating`, `ip`)
    VALUES ('{$rating}', '{$_SERVER['REMOTE_ADDR']}')

In fairness these aren't your typical "straight out of $_GET" vulnerabilities, but they impart a lax attitude towards security. For example, in the latter example above, $rating is escaped just prior to its use in that query, but $_SERVER['REMOTE_ADDR'] isn't. In the former, there is no indication whatsoever of where the variable $articlesPerPage has come from so it's impossible to tell.

The notion that some variables are "safe enough" that they don't need escaping is naive. $_SERVER['REMOTE_ADDR'] is a global variable that any other code anywhere in the script can write to. While you can't get owned immediately after putting that code live, it is still a tiny little SQL injection vulnerability waiting behind the scenes for an attacker to chain it together with some other similarly minor flaw and break in.

To this day I still come across PHP code that is vulnerable to serious, immediate SQL injection vulnerabilities and it isn't always old code. I'm not so sure that the PHP community is so quick in learning from its mistakes.