Yes but it only takes one eval or config flag set wrongly for that to be moot.
It's perfectly possible to write a pure C web page that is 100% secure. It just requires experience.
The same with all other languages. PHP doesn't protect the novice, neither does C. Experience does.