You can't escape it ahead of time, for the same reason you can't reliably block or remove "dangerous" inputs ahead of time — you can't reliably know all the pla

You can't escape it ahead of time, for the same reason you can't reliably block or remove "dangerous" inputs ahead of time — you can't reliably know all the places and contexts they will be used in. So you escape at the point of use, as late as possible, when you know exactly what escaping you need. It's also easy to forget to escape. This is why it's best to have tools and practices that automate it, e.g. HTML templating engine that escapes everything by default, e-mail composing library that automatically converts text to whatever MIME magic is required, etc.