Perl has awesome feature called "taint mode", where data derived from outside of the program may not be used to affect something else outside of the program. Every variable has a "taint flag", and it's a programmer's job to "launder" the data. Any attempt to use tainted data except for use in specifically permitted cases (like in print or syswrite calls) will result in a error. Concatenating tainted string with untainted one will result in a new tainted string.

Django has similar, albeit somehow weaker concept with SafeString. Unfortunately, I'm not familiar with Ruby/Rails.

However, consider outputting data as JSON for some fancy AJAX client-side stuff. While I doubt someone will forget to properly escape JSON, forgetting to escape strings as HTML is fairly easy, and no taint checks would prevent you from doing this.