Sanitizing input it's not just "let's replace these weird characters". That's what crappy programmers do when they adopt the "can't fail a request" mentality of

Sanitizing input it's not just "let's replace these weird characters". That's what crappy programmers do when they adopt the "can't fail a request" mentality of certain paradigms (I'm looking at you PHP.) When modifying data using some secret criteria and doing the unexpected is better than showing a validation error, all bets are off.