I have been told that generally speaking, asp.net web apps tend to be more secure than php, since asp.net has some automatic security measures, for example, by default it doesn't allow remote file inclusions. And when you code in php, you have to take care of those things yourself, so some developers might forget to do that. So my question is, generally speaking, are asp.net web applications more secure than php web apps?
ASP.NET will be more secure than PHP if the developer masters ASP.NET more than PHP. And vice versa.
There are many claims that a lot of features of PHP seem to have been designed by a lemur who had taken acid, leading to a rather tortuous set of features and thus potentially making the task of developing securely rather harder than what it could have otherwise been. However, these details are dwarfed by the skills of developers, or lack thereof. Regardless of the language details, the developer must think of "what could go wrong with the code" and there is no automatic tool which will do the thinking for him.