Well, use libraries/frameworks that ENFORCE you to sanitize and makes that exceptional case to output raw content. Examples. PHP: Using mysql_escape_string is

Well, use libraries/frameworks that ENFORCE you to sanitize and makes that exceptional case to output raw content. Examples. PHP: Using mysql_escape_string is a no-no - you will forget to add it one day. Using parametrized queries you won't write unsafe SQL. .NET Core - Outputting to HTML by default only outputs those chars to HTML which are in predefined UTF range. All other chars will be converted to HTML entities. If you want to output raw, you must explicitly use @Html.Raw https://docs.microsoft.com/en-us/aspnet/core/mvc/views/razor?view=aspnetcore-3.1#expression-encoding https://docs.microsoft.com/en-us/aspnet/core/mvc/views/razor...