Question: Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction. 

CLARIFICATION: I think by abstraction what my friend meant was that the HTML sent is right in the PHP/Cold Fusion file, so it's not like the HTML is abstracted from the script in that sense. By the way, the comment was more directed towards Cold Fusion than PHP (but I guess it's the same since PHP can be imbedded within the HTML that is sent).

Answer: 
I'm not sure how best to approach your question, other than saying "no, it's not a security issue". Abstraction has nothing to do with it. I'm not sure what your friend meant by it, but PHP *does* have abstraction (classes, inheritance, etc.) and *doesn't* require you to embed any HTML in your page at all. Modern PHP sites tend to have a data layer, a logic layer (usually facilitated by a set of classes that represent virtual objects on the site), and a presentation layer. CF likely has similar constructs.

One thing I will note (though I can't speak for CF) is that it's notoriously easy to write terrible PHP code, in part because it's so forgiving, and in part because most tutorials don't cover any basic security requirements.

However, here's a few reasons why PHP is considered "insecure" by some:

* Silent type juggling, leads to difficult to spot logic errors.
* Default configuration leaks information (displays errors, `php_info` and `exec` enabled, etc)
* Tutorials for MySQL have a heavy dependance on `mysql_query` with string concatenation, rather than parameterized queries with PDO or MySQLi.
* No in-built output filtering functions for XML, JavaScript, etc. The APIs for outputting safely to HTML aren't clear and simple, either.

However, **no PHP code is transmitted to the client at any point**. It is entirely server-side. It executes on the server, and outputs a result, which is usually HTML.

Don't get me wrong - I actually quite like PHP. It's easy to use, and (despite its quirks) can scale pretty well too. The problem is that it's *too easy* to write code. PHP makes it remarkably easy to introduce XSS, CSRF, LFI, RFI, SQLi, etc. into your code, because they don't document the potential risks alongside the API reference, nor do they provide obvious and standardised ways of approaching security issues.

My final point is this: languages aren't inherently insecure. Some may make it easy to write bad code but, in the end, it's the developer who created the insecurity, not the language.
They're not sent to the client. The tags may be embedded in HTML on the server, but they're not included in what is sent to the client (unless your server is misconfigured).

You can write secure or insecure code in any language. You'd do better to spend your time researching common attacks like cross-site scripting and SQL injection and making sure you avoid them.