Just the other day I added a recent example to that page, from https://www.wsj.com/articles/internet-mangles-names-accents-web-forms-11664462695 https://www.wsj

Just the other day I added a recent example to that page, from https://www.wsj.com/articles/internet-mangles-names-accents-web-forms-11664462695 https://www.wsj.com/articles/internet-mangles-names-accents-... where it is obvious that databases are storing pre-escaped data. This might be because of really old data and old code that saved it. But changing this decision is very hard, so I imagine many systems that adopted escape-on-input once are stuck with it.