Sanitizing inputs requires you to know what you're sanitizing against. Nobody knew about all these expressions that log4j would accept anywhere until a few week

Sanitizing inputs requires you to know what you're sanitizing against. Nobody knew about all these expressions that log4j would accept anywhere until a few weeks ago, so nobody could have sanitized them out of inputs. Logging to a text file is nice for a toy app. For large-scale Production apps, you're gonna need log rotation to not overwhelm your disk space, transport to a centralized service for aggregation and bulk querying, and a good mechanism to append some tags about the request, service, instance etc to the log data to make it easy to query. That's not so easy without a nice logging framework.