1)Memories of the older days where mysql_escape vs mysql_real_escape 2)It's 2014 and Drupal just got exploited by a sql injection attack. 3)Because of php's weak typing, php will accept a lot of strange input such as arrays with variables in them. Which is weird and can lead to some remote code execution 4) If you're busy defending against xss and sql injection still who is defending against more esoteric attacks like csrf, denial of service, timing attacks, etc? (If you can tell me about csrf and have set up csrf protection in a project you're in the minority of php developers)