Actually you can't "sanitize" inputs as you can't know upfront in which context this data will end up. So the rule is: Never try to "sanitize" inputs, always s

Actually you can't "sanitize" inputs as you can't know upfront in which context this data will end up. So the rule is: Never try to "sanitize" inputs, always sanitize outputs respective to output-context. Regarding XSS there is this nice overview: https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Ev... As this is a complicated topic one should never try to escape things "by hand", for example by some "clever" regex. You won't catch this way all the possible encodings!