[lupin_sansei]

Not sure that's true. Out of the box ASP.NET has request validation enabled by default that screens out lots of opportunities for XSS https://www.owasp.org/index.php/ASP.NET_Request_Validation PHP doesn't have that for example.

[girvo]

> PHP doesn't have that for example.

Bare PHP, sure, but pick basically any framework that any modern PHP-based web app is built on and then it does, no?

[emodendroket]

Symfony certainly offers it.