For traditional PHP apps wishing to continue SSR and server-side templating, integrate HTML-aware templating (PHP has always been half there considering embedded PHP is using SGML processing instructions; it "just" needs to offer additional, more sophisticated, injection-free SGML entity-based mechanisms).

For highly dynamical apps, consider porting to JavaScript on the client side, and use PHP only as a service backend language. That's what I understand newer PHP frameworks are doing; but this will only be attractive for migrating legacy PHP apps rather than bring new users.

I don't see the upside to the effort of porting to js. You still have all of the same pittfalls. Yes, you can build a DOM with 20x the code and 1/20th the performance ... or you can just call htmlspeciachars() in php. Yup, security is tedious and you need to stay on your toes.