I think with the proper tools (and I don't mean using the bare language, but enough libraries that give you nicer abstractions), it can be used for doing things properly just fine. Heck we do a living out of building custom apps for customers that range from financial world to data-oriented startups. You just have to know what you are doing, like with any language really.

- The mbstring ext gives you more or less decent transcoding support. I never had huge issues since it's generally ISO-8859-15 or UTF-8 I'm dealing with, but you may have a point. I can't answer conclusively.

- date handling overall is really great in PHP, I don't know about it in details in every language, but I know in some it's a massive pain. See http://php.net/DateTime and http://php.net/manual/en/intldateformatter.format.php for locale aware formatting.

- SQL injection is handled by the PDO db connectors just fine, and all libraries abstracting this basically take care of it. Unless you follow 10 years old tutorials it's pretty hard to have SQL injection leaks.

Etc etc.

The key is just this: know your tools.