No one mentioned magic. Frameworks are designed to do what PHP developers wind up implementing in an ad-hoc, haphazard way themselves, and tend to be better at doing it on average. Any code can have security issues but I'd trust a battle-hardened open source PHP framework over some random coder's hubris any day of the week.