I don't know if I'd call XSS "the real bitch". I remember reading a blog post a while ago (that I sadly can't seem to find now) which recommended using a good variable naming system - something like us_blah for unsafe content, and s_blah for safe content - and only writing / storing safe content. Furthermore, the only thing that returns safe content is the appropriate escaping function, so you can look at each line and notice that "s_blah = us_blah2" is wrong.

I always wondered if it'd be possible to use the type system of a language to do something similar - make a "safe to output" type, and a "not safe to output" type, which are not mutually convertible, and then write a function that converts between UnsafeStr and SafeStr. Then, you can write all your code to only work on and only print a SafeStr.