An interesting thing you may have missed is that the PHP community actually aggressively removed posts from stack overflow suggesting the old broken autoquoter approach. I'd say that PHP actually has an incredibly security minded community at this point.