I think the problem here is you think it should be a language function and I think it should be an extensible external implementation. The problem is the blacks

I think the problem here is you think it should be a language function and I think it should be an extensible external implementation. The problem is the blacksmith, not the tool. LOLPHP stuff is consistent in how it happens. It doesn't magically change. So, if you know it happens, you adjust and adapt. Its not wonderful but adding more magic is the opposite of the solution. The solution is to get rid of all the magic language features that don't work quite right and clean up the ones that do. > Meh, library problems. PDO shouldn't be baked into the language, but neither should anything else. That is kind of my point. All of this should be separate implementations. > tl;dr Stop allowing everything to be concatenated with everything else, and just because PHP tried bad solutions to a problem doesn't mean that problem is unsolvable. Provide evidence of a truly secure language with all potential contexts baked in. > Not really. Making everyone access GET/POST vars in the same way is a bad idea. Better to provide getter functions like "get_param_unsafe" and "post_param_unsafe" for this, then provide a bunch of common alternatives which provide escaping like "get_param_html", "post_param_quoted", etc. Quoting strings is not security. People will use that "post_param_quoted" just like magic quotes and everything else and fuck it up. > Yes you can: you can make it impossible/very difficult to do it incorrectly. Again, stop allowing everything to be concatenated with everything else and this issue will be magically resolved. Concatenating quoted strings to each other is an unsafe operation. So, no, you can't. > If only PHP were capable of providing some kind of "interface", which other code could "implement"... It does. There are security libraries you can use. Its not a language feature. PHP has repeatedly failed at attempting to add security-as-a-language-feature because its complicated, difficult, and most people won't understand it anyway.