If you use any decent web framework they protect you against them out of the box. I read a lit of love about libs against frameworks or sql vs orm today. But when i use django, i know that password hashing, input sanitization, html escaping, csrf tokens and the like are rock solid and enabled by default. It saves you the dilemna of security vs productivity at least for the minimum package.