@IluTov the problem with the taint path, is that it leads to more and more complexity. e.g.
takesHtml('<p class=' . htmlentities($someOtherVar) . '>' . htmlentities($_GET['name']) . '</p>');
would need a second kind of flag at least. And for the record, I use
esprintf as that's a simple solution, rather than trying to have stuff automagically do the right thing.