Yes, it just works. That's also where there are thousands of poorly written sites out there that chug down sql injections like they were going out of style.

PHP is a reasonable templating language. That's what it should be used for.

If you use a framework, you're golden, but at that point you could be using any language.