Perhaps what we need is a language/platform that has built in strings that track not just the code page type encoding, but some kind of "intent assertion" as well -- is the string intended to be encoded for a particular output? Combining an "unknown" string with an HTML (or SQL, or PostScript, or JSON/JavaScript, ...) string would produce an exception.

Such a mechanism would have to include encoding functions (and assertion override functions), of course.

It seems this would help alleviate many types of fill-in-the-blank injection problems as well.