Where to protect DB data against XSS injections?
One might forget HTML encoding, but how about doing it automatically:

class HtmlEncode {
    private $obj;

    public __construct($obj) {
        $thos-&gt;obj = $obj;
    }

    public __call($method, $args) {
       $ret = call_user_func_array($this-&gt;obj, $args);
       if(is_scalar($ret)) return Reform::HtmlEncode($ret);
       return new HtmlEncode($ret);
    }

    public __get($name) {
       if(is_scalar($obj-&gt;$name)) return Reform::HtmlEncode($obj-&gt;$name);
       return new HtmlEncode($obj-&gt;$name);
    }
}


Create $data = new HtmlEncode($this) and now you can safely use:

&lt;div&gt;&lt;?php echo $data-&gt;myData; ?&gt;&lt;/div&gt;
&lt;div&gt;&lt;?php echo $this-&gt;myMethod()-&gt;name; ?&gt;&lt;/div&gt;


You always get either html encoded string or object wrapped in HtmlEncode class.

I wrote it out of my head, so it's untested, it should check if the method or variable is defined, handle arrays, but it's left up to you ;)