#html-encoding

PHP strings that HTML-encode themselves on echo, interpolation, and concatenation. XSS-safe by default and at least 3x faster than calling htmlspecialchars() yourself.

PHP/MySQL database layer where values only enter SQL through placeholders and every result HTML-encodes itself on output. Faster than prepared statements plus htmlspecialchars() on every measured page, within microseconds of raw SQL.