Every time this topic comes up, the comments are full of people talking past each other because they're operating under different definitions of "sanitize", "in

Every time this topic comes up, the comments are full of people talking past each other because they're operating under different definitions of "sanitize", "input", and "escape". And now in this case, we add "output" to the confusion. Is the SQL query you send to your DB input or output?