I've been involved with multiple HTML and XML parsers, but never validators. :) The reality ten years ago, when a number of prominent XML advocates were using

I've been involved with multiple HTML and XML parsers, but never validators. :) The reality ten years ago, when a number of prominent XML advocates were using XHTML (and actually using it as such, serving it as such), almost all of their sites had user input means where the input was sanitized well enough for HTML to be secure (and not have any markup injection), but not for XML well-formedness (they got all the markup injection risks in XML, but not all the other WF requirements). If the very people who claim XML is easy can't get it right, can everyone else?