> You can't account for and sanitize all levels of stupidity on user inputs. That is false and a defeatist attitude. Sanitization is not the right solution an

> You can't account for and sanitize all levels of stupidity on user inputs. That is false and a defeatist attitude. Sanitization is not the right solution anyway. If you are working with any form of a database and don't know from the top of your head how to avoid query injection attacks then you should look up in the manual of your database. The solution is most often called "parameterized query" or something similar.