You can't sanitize "correctly" if you don't know where the data will be used. This is exactly why the article advocates for escaping output (e.g. immediately be

You can't sanitize "correctly" if you don't know where the data will be used. This is exactly why the article advocates for escaping output (e.g. immediately before inserting a string into a SQL query) rather than sanitizing input (e.g. by deleting single-quotes or other potentially problematic characters from strings as soon as they're received).