A good point, but it is obscured by a terrible choice of vocabulary: in this article "sanitizing input" actually means specifically trying to sanitize input of

A good point, but it is obscured by a terrible choice of vocabulary: in this article "sanitizing input" actually means specifically trying to sanitize input of the whole system as soon as it is received (quite impossible, given the open-ended and conflicting nature of sanitization needs) and "escaping output" actually means sanitizing the input of a specific subsystem for a specific purpose. Given a faithfully persisted and assumed unsafe original text, SQL query builders can turn everything into SQL strings or die trying, XML parsers can check entity expansion size and other traps, HTML generation templates can introduce fancy markup to surround arbitrary text, XML generation templates can escape input wholesale in CDATA sections, and so on. It's the traditional principle of separation of concerns.