On: Don’t try to sanitize input, escape output (2020)

[kolinko]

That is true only for simple systems that don't change often and that have a single view of the data.

For most real world use cases your approach is break even at best, and often way worse.

[42lux → kolinko]

You mean it's not suitable for the deploy every hour crowd it has nothing to do with complexity.