While talking with one of my coworkers, he was talking about the issues the language we used had with encryption/decryption and said that a developer should always salt their own hashes. Another example I can think of is the mysql_real_escape_string in PHP that programmers use to sanitize input data. I've heard many times that a developer should sanitize the data themselves.

My question is what things should a developer always do on their own, for whatever reason, and not rely on the standard libraries packaged with a language for it?