+1. I wish they did something to highlight that the detail they’re providing is uncontextualised. Protecting against XSS* is vastly different in a server render

+1. I wish they did something to highlight that the detail they’re providing is uncontextualised. Protecting against XSS* is vastly different in a server rendered PHP app than React. I also feel like ‘always escape input’ can cause double encode / double decode bugs (which can be used for XSS) - a better option would be ‘design an XSS mitigation strategy at the start of a project and conform to it’. XSS is used as an example, but this is pretty relevant to all injection, techniques.