My humble opinion is that filtering is the wrong abstraction for this problem. XSS, SQL injection and friends are not about input filtering, they're about output encoding. They occur because you interpret user supplied string as a language fragment instead of encoding the string as that languages string literal. See http://blog.moertel.com/articles/2006/10/18/a-type-based-solution-to-the-strings-problem for a discussion about the problem and a possible solution. (which unfortunately seems rather unimplementable in PHP, certainly not with the current set of PHP core developers)

There is a use for input filtering and that's validating that what's submitted matches some rules about acceptable data. E.g. supplied string is a valid email or selected select box item actually exists in that select box. But that is completely orthogonal to output encoding. For example "Jane d'Or True" might be a completely valid username, but results in SQL injection if inserted in SQL unencoded.

Unfortunately I don't have the time nor the motivation to help you in your noble effort to make creating secure PHP applications easier and more robust. I have moved on to using Python for main development, as Python doesn't fight such "complex and useless OO bloat" concepts as making strings extendable objects. I managed to implement the aforementioned language fragment model in 40 or so lines, so when I concat HTML and unencoded user supplied strings I get an exception.