edit I got some good responses about Frameworks but the crucial part of this is that it's built into the programming language itself, so it's literally impossible to write an XSS vulnerable or SQL injectable web site even if you wanted to. (Of course you could write a SQL parser that takes a string and converts it to an SQL data type then executes it, or an HTML/JS parser that enables people to submit their own HTML and JS to be embedded in your site.. but no one would write a parser by accident)
Currently, a web server runs a PHP script which outputs a string of text which is interpreted as HTML by a parser.
But if the web server ran a different language lets call it "SPHP" (secure PHP) which outputs an HTML data structure rather than text.. then it gets rendered into a string by the web server and sent to be interpreted as HTML...
(Mathematically this means instead of writing a function
php : web request --> string you write
sphp : web request --> html and there is a function
render : html --> string. The important thing to notice is that the image of the function render only contains strings which can be parsed into valid HTML.)
at first this would just mean you can't ever have a unclosed HTML tag in your output, but then I realized..
You could also completely solve XSS with it: when ever you try to put a piece of text (e.g. from user input) into the HTML data structure it will escape it in exactly the correct way to stop an XSS vulnerability.
In fact the idea can be used "backwards" for SQL: rather than calling
mysql("SELECT mytable WHERE name=$user AND password=$pass") you would build an "SQL query data structure" that would have everything escaped correctly as you built it.
It seems like if you programmed a web site using the SPHP language it would be completely free of XSS and SQL injection.. the top 2 OWASP vulnerabilities.. but that can't be right because no one is moving to SPHP despite the amount of hacks that cause so much security damage and stuff.. so what have I overlooked?