I think one of the reasons that PHP initially got a bad rap here years ago is that one of the simplest documentation sources online, W3schools, initially had so

I think one of the reasons that PHP initially got a bad rap here years ago is that one of the simplest documentation sources online, W3schools, initially had some code examples that were obviously insecure. If I remember right, it was putting raw user-submitted text directly in the database query or something like that without escaping it in any way. PHP code in the wild can be really awful or perfectly great.