Unfortunately PHP seems to have this reputation. It's not so much the language that is the problem but the people using it. PHP typically had such a low bar to entry that literally anyone could pick it up and do anything and everything with it. And quite frankly there were (and still are) a lot of beginner tutorials out there encouraging people to do very stupid insecure stuff. It now seems to be an image that stuck.
If you take a look at the OWASP Top 10, and any big data breaches recently, they are all caused by human error. SQL injection being the major culprit.
This is my general experience with all platforms and operating systems. You have to keep up to date.
PHP was early on the web scene, and like ASP it encouraged a lot of bad practices (like concatenating user input into SQL strings) before people knew better.
These days, in the hands of a competent developer, it's no worse than any other mainstream stack as far as security goes.
Most of it comes down to being developed ad-hoc with convenience for solving a simple problem right now as the main driving force.
Remember register globals? That was a minor convenience which took ages and millions of exploits to be removed – I remember lobbying for that in the late 90s.
Similarly, you mentioned SQL injection. Unlikely as this may seem now, there was a time when things like prepared statements were an exotic new feature with limited library support and a certain school of programmer thought they were probably too slow. The docs and most tutorials didn't mention things like validation or escaping prominently so most PHP developers were trained to slop everything into strings. When PDO came along, this persisted for too long as well and even after they started recommending placeholders you didn't get something like all of the mysql functions saying “Don't use this, it's unsafe”. I've heard that this has improved but it's been years since I needed to look.
Similarly, look at the lax attitudes toward error handling — errors are ignored by default, database errors or warnings have to be explicitly requested, etc. That's “easier”, saving whole seconds of learning at the expense of millions of successful exploits and hours spent debugging.
PHP is the only lasting language where making code that allows SQL injection is easier than code that forbids it.
PHP includes all the worst practices you'll find on any languages. Javascript has the eval problem - PHP has it too; Perl have the too fluid type system where you can't specify anything - PHP too, except that it lacks Perl's tainted mode; Asp made it easier to create code subject to XSS than code that isn't and is subject to directory traversal - guess what, PHP copied it... and the list goes on and on.
This release fixes still some more problems, but PHP will never become a good language.
Pretty sure this is true for any language, the key difference is education. When learning JDBC for example, you're taught to use prepared statements with params vs. string concatenation.
A history lesson: PHP was originally known as PHP/FI which meant "personal home page form interpreter". That people started using it for "real work" took everyone by surprise, including the author!
If you're dealing with more mainstream PHP apps like WordPress or Magento, its important to stay up on the core updates but also monitor the plugins and templates being installed. The majority of the attack surface on those apps is in the plugins because they're almost never audited.
As for modern customer apps, written in frameworks like Laravel or Symfony, you're usually fine. Those frameworks are on par with Django and Rails in being very hard to shoot yourself with.
BS. Most PHP4 code runs just fine, as do PHP5 code. Almost no one used object oriented code in PHP4 days (it was slow!), so the incompatible changes aren't a problem. And all you need to do is to search and replace some function names like mysql_* to mysqli_*. Most old code bases from PHP4 days also didn't rely on frameworks at all and were completely written from scratch or copy&pasted together - actually an advantage in this case.
Upgrading an old Python or Ruby code from 1.x/2.x days is a lot of more work (as it always includes upgrading to a recent framework version) than upgrading from PHP4 or PHP5 to PHP7.