To be fair to PHP, a lot of other languages had bad examples around as well. Pretty much every language has a way to do string interpolation on untrusted input and pass it to to a database .
String insertQuery = "insert into student values('" + studentNo + "','" + studentName +"','"+ studentAddress + "','"+studentAge+"')";
int result = statement.executeUpdate(insertQuery);
Result #5 on Google for: jdbc insert program example
And this one, #1 for "jdbc example variable where" on Google:
String query = "select LastModified from CacheTable where " + " URL.equals(url)";
Otherwise they would not be Turing complete.. but defaults/easiest route does matter very much in this case.