Don’t try to sanitize input, escape output (2020)
Sanitizing inputs is not what you realistically want. You should prohibit certain types of input. Whitelisting strings is that what I would call it.<p>You should escape outputs, of course (not that anyone in 2022 thinks otherwise).<p>Why escaping outputs alone won&#x27;t work is because user inputs will be stored in some database and you can&#x27;t realistically predict how, when, where it will be used. Years in the future. User name could be used as a filename once, opening up possibility of shell-based exploit. It could trigger a little-known spreadsheet formula vulnerability when exported for analysis. Novel, interesting xss attacks are common and produced every day. That could be even not your code, but the code your client or partner organisation run. You just never know.<p>One common defence is user names (and other freeform fields) should not be allowed to be arbitrary bytes.<p>That is defence in depth, an established practice.