> Any sanitation of user-generated content must happen server-side. Um, yes? You should treat every request to hit the backend as a potential attack, otherwise

> Any sanitation of user-generated content must happen server-side. Um, yes? You should treat every request to hit the backend as a potential attack, otherwise you're going to have a _really_ bad time at some point.