ASP.NET MVC provides default protection against cross site scripting. Just wondering, if PHP frameworks do the same?
- Zend Framework offers an Escaper component to escape output and defend from XSS
- Symfony provides an automatic output escaping feature
- CakePHP before version 2.4 provided a sanitization class
I recommend you the following lectures for further information: