Most PHP developers I've worked with had no idea of different encodings, serializations, etc. They just wanted to echo $_GET['input'] and be done with it.
I worked at an outfit that hired some utter fuckwits who had been recommended by some more fuckwits for something and they did it in PHP and put it on budget shared hosting.
A week later: SQL injection, CSS, CSRF attacks and someone who had cracked the server was injecting malicious js in the page header.
That day was the day that management finally listened to my doomsaying about security...
You _do_ know that some of he largest sites on earth run on Wordpress, right?
They are just fad artists.
I warned the local lottery about the security issues they had with their website (I was doing them some side work) but they didn't listen until someone defaced their website and the first thing they did was ask me if I did it.
Sort of like this:
Programmer "Uh you really should use a numerical keypad to the server room, it is more secure than the doorknob lock which is so common anyone can find a key that fits it and rob the server room."
Management "Feh! Forget it, we don't have the budget for it. Besides that doorknob lock was on sale at Lowe's and fit out budget. The clerk there said it was lockpick proof, and that's good enough for us."
Later on someone picks the lock and then steals all the server hardware.
Manager "Someone broke into the server room. Hey programmer was it you, you seem to know a lot about locks and stuff?"
Programmer "No it wasn't me, if you followed my advice with the numerical key pad you wouldn't have had this problem. The lock you used made the server room insecure and allowed a robber to easily pick the lock and rob us all."
Manager "Yeah whatever, I'm pressing charges against you anyway."
And if your prior employment recruited based on connections rather than competence that speaks to a management issue that couldn't possibly be solved by switching languages.
(this isn't really to single out your comment meaty, could be attached to anyone else in this thread)
A better example would be Django, most server-side Java frameworks, Ruby frameworks like Sinatra and Padrino, most Erlang code I've seen is solid, Haskell users generally know better, etc.
Meanwhile on planet Earth every popular software package has had some issues. That's natural, security is hard and requires constant vigilance, and people are bound to err or oversee something from time to time.
It all started with employees who had Irish names like O`Brian, they would cause database errors when trying to insert their name. I found out the data entry clerks didn't know the difference between the "`" apostrophe and "'" single quote character. So I wrote a SQL filter function to double up the single quotes if one is entered. As it turned out some employees where using the single quote for SQL Injection and it foiled their attempts and they filed support tickets for it. I could not replicate the error and then I asked how they were entering the data, and none of them wanted to tell me. So I made a logging code when their user ID is used to access the database and noticed they were trying to use the single quote to gain access to other tables and in some cases entering "1 or 1" and other stuff that just returned all the results in a table. I had to filter out SQL commands, system characters, and other things, even HTML statements because they would stick them in there to deface ASP pages and insert messages.
This was a law firm I worked for, and they had no clue their users were doing this, it was an Intranet site that was not accessible from the Internet. For stopping their 'cracking' of ASP pages, I gained a lot of enemies for that. Some would send denial of service attacks to my Windows PC, some would file fake complaints about me to get rid of me and replace me with someone who didn't sanitize inputs. Eventually I got too sick to work, and was fired for being mentally ill after all the stress I had caused me to develop schizoaffective disorder.