Sure, sanitizing on input doesn't fit all situations but I think it's good for many. Note, I'm only talking about XSS (think preventing iframe and script tags).

Sure, sanitizing on input doesn't fit all situations but I think it's good for many. Note, I'm only talking about XSS (think preventing iframe and script tags). 1. The number one reason is that it reduces programmer error. If we never store corrupted data then we're never at risk for displaying it. This is a practical concern because I've observed I and other programmers I've worked with often make errors. I have no knowledge of whether or not this is true for all programmers. 2. Nothing gets messy because we don't escape anything. Certain types of data simply aren't let in. 3. There are some edge cases where we do relax the rules, primarily for the admin user. 4. People should still be able to store code snippits but they need to escape them first.