Personally, I think a lot of the perception is just that PHP appeals to a broad audience, so there's a lot of unskilled people producing code.
All the more reason for the language to be opinionated and force developers do things securely. The path of least resistance should be to write good code; let developers abuse the language if they really want to, but make them have to work hard to do that.
Sure. That's basically "PHP is a terrible language for beginners working on their own", which I don't disagree with. On the other hand, for example, SQL injection isn't any more or less likely with PHP vs say Python, Perl, or Ruby. All four encourage you to use prepared statements, placeholders, etc. But all four allow random strings too.
> That's basically "PHP is a terrible language for beginners working on their own", which I don't disagree with.
I think the problem is that it's a very easy language for getting your feet wet and learning the basics. "Just mix this for loop in with your HTML! Stick it in along side your static .html files! Dynamic content!" Plus there are literally decades of documentation and examples online. The trouble IMO is that up until PHP 7, very little original cruft was ever actually removed from the language. mysql_escape_string was deprecated in v4.3 (2002!!) and still exists on the default v5.X package installs available for Debian, CentOS, etc. It's really hard even for experienced programmers coming from other languages to know what's actually currently the best way of solving a problem. You have to be a well-versed expert to know all the quirks/pitfalls and how to handle them properly.
Originally php and the MySQL/postgresql libraries had no way to use placeholders so you had to use patterns that made it pretty hard to avoid sql injection. Which is why they had kludges like magic escaping, of course.
All the more reason for the language to be opinionated and force developers do things securely. The path of least resistance should be to write good code; let developers abuse the language if they really want to, but make them have to work hard to do that.