You're thinking about this as if data can be in one of two states – untrusted or sanitised. This is not the case. When you output arbitrary data, you need to

You're thinking about this as if data can be in one of two states – untrusted or sanitised. This is not the case. When you output arbitrary data, you need to encode it in a way that is suitable for that context. These contexts might be: - Generating a web page. - Including in a JSON response from an API. - Sending an email. - Storing in an SQL database. These all use different formats / protocols that use different syntax to encode data. How you correctly encode data for one of them is different to how you correctly encode data for another of them. There is no method of taking untrusted data and "sanitising" it so that it is correct for all of them. What works for one will break for the rest. If you want to handle arbitrary data correctly and safely, store it as-is and when the time comes to use it, encode it appropriately for the context you are using it in. Where possible, use tools and systems that get it right by default instead of requiring developers to remember to encode correctly, e.g. generate HTML with templating engines that encode data as HTML by default, and use parameterised queries with SQL.