On: Don’t try to sanitize input, escape output (2020)

[sfvisser]

It’s really not. The point is that sanitizing output is a better way to protect the host and the client.

[worthless-trash → sfvisser]

Sure, keep writing exploitable code then, have fun!

[cowboylowrez → sfvisser]

yes, and the article clearly agrees with you, different destinations of the data have different escaping requirements.