> user supplied data should be sanitized in the strictest possible manner before anything is done with it, including logging Oh come on, how would you even do

> user supplied data should be sanitized in the strictest possible manner before anything is done with it, including logging Oh come on, how would you even do that if you don’t know how the data is going to be interpreted by parsers that nobody knows they’re using? WAFs have been trying to do this since forever, but it’s always been security theater that separates gullible companies from their money and randomly blocks users that use “special” characters like slash or quotation marks. I guess you could base64 encode everything, but that wouldn’t save you from the terminal bugs you mentioned. At some point you’re gonna have to undo the “sanitizing” and look at the text.