News for hackers. Stuff that matters.
Re:PHP 7.1.0 Released by tyingq on Friday December 02, 2016 @09:38AM (#13088816)
As far as I know, most templating frameworks (php or otherwise) don't really solve this either.

PHP's native templating is perhaps prone to more issues in this area, but template frameworks (for the most part) still allow you shoot yourself in the foot with data contained in strings.

Re:PHP 7.1.0 Released by combatentropy on Saturday December 03, 2016 @01:14AM (#13094602)
Most templates I've seen escape HTML by default. You have to type something extra to unescape it.