Someone posted an article above [1], but citing from it, there is a function called mysql_real_escape_string. Although early JS also has quite odd language choices, it follows a consistent philosophy. To me it boils down to LISP in C syntax with weak typing. Past PHP feels more like a collection of stuff. But I assume modern PHP can be a viable choice if used with a modern framework, linter etc.

[1] https://eev.ee/blog/2012/04/09/php-a-fractal-of-bad-design/