It's true that you can be an idiot in any language, but I have written production code in every 'high level' language of this type and only PHP seems to suffer from this problem. Take a random mail form, even has its own domain: http://jemsmailform.com/
Finding the obvious problems I leave as an exercise.
The fault is with the programmer. No one else.