Comment by tannhaeuser

That's what baffles me with PHP. Instead of building on PHP's unique capabilities, they try to become more like Java. When PHP was and is quite successful as server-side language for HTML templating, rooted in embedded PHP triggered from SGMLish processing instructions in otherwise static HTML. It's only that they made such a hack job without context-dependent, HTML-aware escaping, making it a primary vector for injection attacks.