Haskell with Yesod comes as close as is practical (if you explicitly tell it a string is safe to use in a certain context, it will not magically figure out that

Haskell with Yesod comes as close as is practical (if you explicitly tell it a string is safe to use in a certain context, it will not magically figure out that you're wrong). If you loosen the requirement to just "secure by default" rather than "insecure code fails to compile", most modern web frameworks have built-in automatic CSRF protection and default to escaping all strings when inserting them into HTML.