Thank you for good answer. English is not my main language, it is fully my fault if i didn't make my position clear. I fully agree with everything you said. A

Thank you for good answer. English is not my main language, it is fully my fault if i didn't make my position clear. I fully agree with everything you said. Always escaping output is the right thing. Sanitization is not what you want, like, ever. > Literally you cannot know where all your data will go when storing it so how do you even begin to sanitize that data? You construct a minimum regular language your inputs should confirm to. In programming parlance this is called regex. This requires knowledge of your domain and, yes, a bit of extra work. So, the comment field on payment becomes an alphanumeric with certain unicode characters. A pain for a user who wants to send a code examples, sure. But should code examples be in payment comment field? And so on. Identifier field? Allow only latin letters and numbers. Custom css user wants to use? Restrict to valid css. Name of some goods to sell? First character is alphabetical, rest alphanumeric and [-#"'*|:,] but never two consecutive special characters, even with spaces between. Pdf? Construct a reasonable pdf regex and match for it. You should publish your regexp and guarantee your database contents should adhere to it. I think this is practical and reasonable thing to do. It would fail against a determined sophisticated attacker, but at least it might give it hard time, and make attack a bit more detectable and a bit less effective.