Earlier quoted context omitted.
It’s really easy to write PHP, which means that people who don’t know about escaping input write PHP. While there are some web-focussed languages (vs frameworks) that deliberately make it hard for you to write that sort of code, barely anyone uses them.
"escaping input" is a notorious delusion. And a bad one. - it is not "input" must be treated , but, so to say - output. It's the destination that matters, not the source. By the time you get the input, you have no idea how and where it will be used. You can tell it right before the output (or, rather, better to call it "use") only. Say, you've got some input that didn't pass the verification and you will have to disp…
I'm working on comprehensive taint analysis for PHP[0], and I'm spending a bunch of time thinking about how to automatically detect those dirty strings.
[0] https://psalm.dev/articles/psalm-3-and-a-half#taint-analysis