The quality of the code in your average PHP project is... less than stellar. Low quality code typically results in exploitable bugs (XSS, CSRF, SQL injection, remote code execution, local filesystem access, etc.).