PHP suffers from the same issue with the <?= syntax. I considered writing an extension to add a <?~ operator which would output htmlspecialchars()'d strings but I never got starting with it. In the same vain as the statement above on JSP but in PHP, why are the two most important functions from an XSS and SQL injection perspective, htmlspecialchars() and mysql_real_escape_string(), the longest function names in the language?