I agree that cleanup is acceptable, and there's certainly some wiggle room in what people call cleanup vs. sanitization and such. But when people chant "saniti

I agree that cleanup is acceptable, and there's certainly some wiggle room in what people call cleanup vs. sanitization and such. But when people chant "sanitize your inputs" and expect it to be treated as sage wisdom, it's in a security context, and it is wrong in that context. Sanitization is not a valid security tool. Mind you, you might be forced into it if your back is against the wall and you're working on other code that is broken and you can't fix that other code's broken failure to escape or whatever. But it's still wrong, just a wrong thing you were forced to do. A richer point of view is more "don't destroy data you don't 100% mean to destroy". Whitespace in the wrong place or stray nulls can meet that bar. Removing characters for "security" reasons doesn't. Destroying data to prevent security issues downstream is not a good idea.