The codebases in PHP that have neglected to use frameworks have typically been of a poor quality, IME. In fact, most security issues I've seen have been in PHP sites from developers who think they know what they're doing and don't use a framework. These are the developers who don't use prepared...