Sanitizing input is one of the best defense's against the Cross site scriting and sql injection attacks, since those account for most of the security attacks, a

Sanitizing input is one of the best defense's against the Cross site scriting and sql injection attacks, since those account for most of the security attacks, also equally important is to html encode the output so that it does not contain any characters which could be used in these kinds of attacks. Cross site scripting and sql injection attacks could almost be prevented by checking the input for the unwanted characters and in case if they got in to your system second level of defense is to html encode them when you ouput on the screen.