What do these things have to do with a framework? PHP's built-in MySQL drivers (MySQLi, PDO, etc) support and encourage prepared statements and parameter binding. PHP's built-in string library supports HTML-encoding output. PHP's built-in filter library supports validating and sanitizing input. Writing apps without some kind of framework might lead to less organized, tighter coupled code, but it doesn't mean you're mashing together strings and ignoring security.