The whole PHP discussion thing is pretty random.
PHP is insecure if you code badly, just like any other language. Personally I have no problem with using an insecure website, so long as I'm not leaving my data with them. Why would I as the user care if your website gets hacked?
Anyway, some of my pet peeves are....
1. Breaking browser functionality. Links in flash can't be opened in a new tab. Javascript links can't be opened in new tabs. Text embedded in images can't be resized. Images in flash can't be "right click save target as". Hijacking my status bar so I can't see where that link is taking me. Sites that popup in a fullscreen window hiding all my browser controls (this one really winds me up). Many more examples in this category.
2. Bad navigation. Too many items on the main nav. No contact button on the main nav. Or the contact button is not the last item on the nav. No "Home" button on main nav. Logo not clickable back to the homepage. No breadcrumbs on large sites. Illogical names for buttons (Just call it "About us" don't get all fancy). Clicking a link and getting ambushed by a PDF document (I hate getting surprised by these). No rollover text on icons. Main navigation that is completely image based, no text on the button.
3. No clear purpose to site. No H1 heading or introductory paragraph on each page. Or a massive long opening blurb that doesn't get to the point. Generic stock photographs that say nothing about the company. No call to action on pages. No clear navigational path through the content. Adsense all over the place. Affiliate content thinly disguised as real content. Products listed without prices. Generic product descriptions and images straight from the supplier. No point of difference about the site. Bad branding that doesn't back up statements made on the page - such as a site on web design that has bad web design, or a SEO site with bad rankings.
4. Site doesn't target it's audience properly. A technical website optimised for 800x600, even though most technical people have big screens. A site that is overly simplified which will just annoy the target audience. A site which uses acronyms that people might not understand. A site on "how to learn english" with no non-english content on the site. A site designed for India which only has white people in the imagery. A blog that doesn't have an opinion and trys to please everyone.
5. Technical stuff. These bother me as a web developer, but are't all that important to a non-technical audience. Firstly, MM_Swap_Image_restore - those noob dreamweaver functions that spread like a virus - use CSS instead. Big wads of JS or CSS in the head of a document. Font tags. Using <p class="heading"> instead of <h1>. Big sites like MySpace having mickey mouse code and setting a bad example for the rest of us. Microsoft claiming they spent months on usability testing, and then go and break the back button on their new design. Bad URLs always bother me. Wordpress blogs with the same old templates. Sites about web design using a template. Sites about AJAX that don't use any AJAX. Sites that include 150kb worth of Scriptaculous and then hardly use any of the effects. Rollover images that don't start loading until you mouseover them. Sites that work in IE only but could easily be coded to work in other browsers. Sites with homepage popups that say you should be using IE (I would imagine this would be especially insulting to mac users).
There are so many things people do wrong on websites, this list is long yet hardly comprehensive.