Earlier quoted context omitted.
That, and I've noticed that the typical legacy PHP codebase is worse than the legacy codebase in other stacks.
I have seen some real crap in Python recently. Then I was asked to move a PHP app to a new server. A quick look at the code looked terrible - string concatenations for all the SQL. (Does PHP provide some way of making this safe, or should I warn management about potential SQL injection? I don't know a lot about PHP).
Take a glance at http://www.phptherightway.com/ to get started