2026-03-12
Stop Telling People To Sanitize User Input
Signal boosting this. Always manage user data transforms for safe encoding on output, never input. Your input code shouldn't know how the data's going to be used. Maybe it'll be put in an email, maybe it's going on a webpage, maybe you're printing it. Each of those have very different sanitization requirements. Your input code should not be trying to account for all the different ways it'll be displayed.
Data given to the system should be treated like your handling explosives. There are ways to safely move it, ways to safely store it, but you don't go messing with it prematurely. Definitely don't trust, touch, look, or lick it unless you absolutely have to.