I've been using Codeigniter - a PHP framework. It's very very well documented -- you have to read the documentation to see how good it is. And the input class is very good at handling most XSS/SQL Injection type attacks.