Perl has such a feature, it's called "taint mode" [1], it marks all variables receiving external data as "tainted" and disallows their usage in sensitive contexts.

PHP has an inactive proposal to implement it as well [2].

[1] http://perldoc.perl.org/perlsec.html#Taint-mode

[2] https://wiki.php.net/rfc/taint