PHP deliberately makes it really, really easy for people who know very little to create useful dynamic web pages. This means that PHP is going to attract a lot of beginners, who create something useful, learn from other useful looking examples, and turn around to teach others how to do this cool, useful thing. The result is a lot of bad code, and a supply of programmers who don't know any better.
It only makes things worse that a large fraction of competent programmers want nothing to do with PHP. This reduces the base of experienced people who are willing to teach others better. But why do they avoid PHP? Well for a combination of factors. In part they don't like dealing with the language warts. And in part it is because they would prefer to work with good code, and there isn't a lot of good PHP out there.
This exact constellation of problems used to inflict Perl. As a shining example consider the case of Matt Wright, an enthusiastic teenager who set out to provide many useful, well-documented and easy to install CGI scripts back in the 1990s. Unfortunately he understood nothing about security, and neither did the people who wanted to use his stuff. The result was the Matt Wright Script Archives, which was an endless stream of security problems for early CGI scripts. Despite efforts like http://www.scriptarchive.com/nms.html, the problem didn't improve for Perl until shared hosting providers made PHP more convenient than anything else. That lead to the problem moving from Perl to PHP.