That's not true. There are many thinks inherently wrong with PHP security. And while you can write crap and insecure applications in any language, PHP actively encourages it.