You can write secure apps in PHP. What I find unforgivable about PHP is that most of the code examples you will find on the web or in books is outdated and insecure. For example, a newbie looking for how to make a DB connection is much more likely to stumble on the mysql_* functions than on PDO.