I have a simple site to develop and would like to learn PHP as I go. I want the site to be secure, scalable, and easy to maintain. Should I learn a framework and PHP simultaneously? If I build off of a framework there will be lots of unfamiliar code in play. Would you say this increases security risks?
There's nothing about using a framework that will impede you learning PHP, and using an established framework will reduce the security risk, as you'll be dealing with well tested code for handling common tasks.
At the core of most of the PHP frameworks in play these days is this simple three step workflow
The URL is requested and routed through a central bootstrap index.php file
The URL name is used to derive a classname and a method name (and action method). This is your main entry point and where you start writing PHP to handle the request
At the end of this method, control is handed over to a view template, which has access to certain values you set in step two.
Pick a framework, learn how it does the above, and then write any kind of PHP you want in the action method and the view template.
Yes, there will be a lot of other PHP framework code in play, but you never have to look at it.
Yes, the framework will have a multitude of features and/or a "preferred" way for handling things, but you only need to use those you instantly understand.
When you start noticing patterns of ugly, boring, or insecure code, take a look at the framework features again. More often than not after "doing it wrong" you'll get insights as to why the framework code did something in a particular way and you'll be happy to hand off the responsibility (I'd say ActiveRecord style models vs. SQL code is a big one here)
As you start using the objet oriented systems the framework provides you'll start to get interested in how they're doing certain things, and then you can start poking at the core framework code.
Although I'm a fan of frameworks, I agree with some of the other comments above. Starting with a framework can be pretty confusing, especially if you're not experienced in the theory of Model View Controller (MVC) object oriented programming (OOP).
Truth be told, I've seen a lot more unfinished framework projects in my day than apps built without a framework. If your application is written with some clunky PHP and the application takes off, then you can hire the necessary resources to move to a framework and get it developed to withstand a lot of usage and utilize resources effectively.
My advice would be to master PHP first, then move to frameworks. My last note on this, many frameworks have flaws as well - so depending on your application needs, applying the wrong framework could drive it into the ground.
Just my 2 cents as a guy that has released a couple of enterprise apps successfully - without using a PHP framework.