Excellent point, onteria. To further your suggestion, if it's reported that some of your user-input variables aren't being escaped then you better check the res

Excellent point, onteria. To further your suggestion, if it's reported that some of your user-input variables aren't being escaped then you better check the rest of the unreported ones, too. And not just in that single file/controller/view/whatever! (EDIT: Or whatever the root-cause of the vulnerability is)