In my experience, the only people who actually prefer writing web apps in raw SQL/HTML either 1) have never written a real web app or 2) tend to write highly in

In my experience, the only people who actually prefer writing web apps in raw SQL/HTML either 1) have never written a real web app or 2) tend to write highly insecure code without even realizing it. A few things that web frameworks/libraries help with: Forms: - Validation & displaying errors & input sanitization. - CSRF checks. - Safe file upload handling. - HTML generation is useful for removing a bunch of boilerplate. ORMs: - Default SQL injection protection. - Query objects help you construct complex queries without having to do a bunch of string manipulation. - Database abstraction (e.g. moving from MySQL to PostgreSQL is a lot easier). - Database migration tools to help you upgrade your schema. Templates: - Inheritance & replaceable blocks reduce a lot of boilerplate code. - Tools to help you safely escape user generated content & transform it for web presentation. Misc: - User authentication. Rolling a secure implementation on your own is no small task. - Secure cookie and session management. - Providing an organized architecture with sensible separation of concerns. Now, to be a solid web developer I agree that at some point you're really going to need to understand the fundamentals of how each of these things works under the hood, but you're crazy if you'd rather write all that code by hand instead of using solid, well-tested, existing libraries for it. Note: That's not to say that using a web framework will automatically make your code secure (the recent Diaspora debacle clearly demonstrates otherwise). However, you've already got so much code to worry about securing in your own application, why would you want to have to hand roll everything else too?