PHP & JavaScript are 2 completely different technologies.
All PHP code happens on the server side.
PHP Example:
CODE
if($password==$Password) ...
For the most part is safe. The client will NEVER see this code, because it is executed & then the proper code is prepared for the browser BEFORE it is sent.
CODE
<script language="JavaScript">
if(password=="Password") ...
In this javascript example, you can view the actual password. Not very secure huh?
Plus, with PHP, you can interact with the server os (to use the server time & not the clients time), Database software, & any hardware that you feel like tinkering with.
Javascript, well, since it's client side, you should keep it simple... or hope that the viewer has an up-to date browswer, with half way decent standards, & has his CMOS battery fairly fresh, so the time isn't off.
On the other hand, the best software to use is what will get the job done. If your friends requirements are all client side activity & testing, then sure, your friend might be spot on. But, again, comparing JavaScript to PHP is apples to oranges, they are simply designed for different levels & browser side execution.
& as far as SQL injection, again, it's best in which ever language you can secure more.
A more secure PHP code is going to protect better against horrible (SQL injection security) written Perl code. The language itself doesn't make it more secure. The fact that you have gone through & removed all avenues of SQL injection in your code is what will make it secure.