Dan Horrigan, one of the members of the development team for the Fuel PHP framework has a recent post to his blog of an overview of the the security features of the framework and how it handles things like input and output filtering.

There are many ways to handle security in a web application, and many things to think about. This is by no means an in-depth look on application security. It is meant to be an overview of how to use the security features included in FuelPHP.

The framework lets you set up application-wide input filtering in your configuration file, making it a nice "set it and forget it" kind of thing you don't have to include in each form. There's three types of filtering - xss_clean, htmlentities and strip_tags. For output, he mentions the "e()" method that escapes your output and strips all HTML tags to prevent XSS attacks.