Add PHP as a vulnerable language

[Seldaek]

Based off the JS tests as the languages are very similar. This has also been reported as a security issue to the PHP project (security reports are private so I can't link to it).

[Seldaek]

I guessI'd mark it as ~ per the README, because */ would be more idiomatic. But anyway I don't think this repo is very much maintained so I'll not spend time updating the PR :)