This is bad programming, period. It has very little to do with frameworks. If somebody is inclined to stick raw POST data into an SQL query, a framework isn't

This is bad programming, period. It has very little to do with frameworks. If somebody is inclined to stick raw POST data into an SQL query, a framework isn't going to save him. Maybe an ORM will, but ORMs are only a small part of what we call frameworks nowadays, and any ORM that allows custom SQL still leaves plenty of room for a lazy developer to shoot himself in the foot. Similarly, a framework won't prevent you from sticking raw POST data into an exec() call. Most frameworks don't even care about those shell functions, they're so heavily focused on providing a smooth CRUD experience. On the other hand, if the argument is that someone who knows how to use a proper framework is likely to be a better programmer than someone who doesn't, I agree and I'm sure that such a correlation can be easily proven.