For example, websites that are built in ASP,PHP,Ruby?
closed as too broad by Xander, TildalWave, Adi, AviD♦ Jan 1 '14 at 0:32
There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs. If this question can be reworded to fit the rules in the help center, please edit the question.
ASP.NET uses something called request validation to prevent stored (and possibly reflected?) XSS attacks. Request validation basically looks for malicious content when requests are submitted. If it finds any it will block the request.
By default request validation is enabled, but users can disable it.
It should be noted that request validation will not necessarily prevent DOM based XSS.
While many languages/frameworks may attempt to prevent XSS, it is never a substitute for secure code. The best defense is to understand the nature of the attack and write code with security in mind.