If I use php to display a count from my database am I causing a security problem?
I would highly recommend you use the CiviCRM API to access this information.

A php version would look something like this:

$result = civicrm_api3('Activity', 'get', array(
  'sequential' =&gt; 1,
  'activity_type_id' =&gt; "Petition",
  'options' =&gt; array('limit' =&gt; 1000),
));


(Setting limit to be something larger than you would expect to get.)

Which would return the count (in addition to the activities which you can ignore). 

{
"is_error":0,
"version":3,
"count":1,
"id":1,
"values":[{
    "id":"1",
    "activity_type_id":"9",
.....


If you are using version 4.6, in place of the get action, use getcount, which will only return the count... without detail and not requiring the limit. 

You can play with the call by going to /civicrm/api/explorer.