Some programming styles are not defensive from a security perspective. As a programmer one should acknowledge that using &quot;render&quot; passing a param right from the request, without validating it, is not a good thing, right? That&#x27;s my point. Some issues here can be solved just by taking the right approach, but won&#x27;t solve for all of them, of course. XSS mitigation works better with encoding rather than sanitization. If you want me to explain I explain.<p>But hey, you won&#x27;t do any good complaining in face of this situation. Time to help people fix it. Peace.