why do php frameworks restrict url characters [duplicate]
Image. If you wrote a framework that was consistently compromised because of poor coding practices of the coders, then you're not going to have a successful framework. Once the marketing image has been tainted, it's not easy to explain "It's the CODERS fault!". A successful framework isn't compromised and provides by default a base set of security enhancements. Personally, I'd much rather start with a locked down framework and only compromise specific areas than have a framework that's often attacked because of their known vulnerabilities (that's how frameworks end up on known exploits lists)