I think he is wrong on handling code as input and visible output (for sites like StackOverflow). No need to filter such input. Escaping your strings will handle

I think he is wrong on handling code as input and visible output (for sites like StackOverflow). No need to filter such input. Escaping your strings will handle that as well. The code <tag/> , for example, will be escaped to <tag/> , appearing in the rendered page as <tag/> (but not _interpreted_ as <tag/> ).