Don’t try to sanitize input – escape output
These two issues have been relevant for over 20 years, older than today&#x27;s college grads. I find it fascinating the new blog posts are being written on a regular basis explaining these two pitfalls. And there are probably a million blogs with these same two examples going back decades. This is an epic re-post in spirit.<p>I&#x27;m tempted to ask, &quot;Why hasn&#x27;t this been fixed yet?&quot; Where &quot;fixed&quot; means, &quot;Something new programmers just starting off their careers don&#x27;t have to jam into their brains?&quot;<p>I know the expected answer will be: it&#x27;s an abstraction of a more complex problem of understanding data and how it is used, and we can talk about how JS and PHP have added native functions to construct custom code to address this problem (hack cough cough hack).<p>But these two cases in particular stick in my craw because there is no fundamental solution presenting yet.<p>So I ask again (and I&#x27;ve been asking this since 2004-ish):<p>Why do these two examples still persist? Why do the frameworks not eliminate them by construction? This is such a repeated pattern, why is it even there?