I think PHP compares well to the saying "Guns don't kill people, people kill people." Most of the time security issues are in the hands of the programers. Although, PHP sure makes it easy sometimes to create those issues.