It's hard to code secure PHP. When starting, I was like: 'So I can just pass a query parameter with <script>alert(1)</script> and do trivial XSS on random sites if I wanted to?' Smart PHP coders always sanitize, but for PHP newbies, it's easy to introduce some vulnerabilities if you don't do defensive coding practices.

There's things like directory traversal attacks too (putting ../../ in requests etc) which you have to prevent. PHP doesn't do it for you, you have to be very defensive with it. Which is why I use PHP sparingly and use Python and Perl more. Those languages even still have potential vulns, but not nearly as bad as the ones you can introduce in PHP IMHO.