Sanitizing inputs in important in addition to memory safety. Sanitizing inputs won't protect you against all bugs. For example, you may store a string in a 256

Sanitizing inputs in important in addition to memory safety. Sanitizing inputs won't protect you against all bugs. For example, you may store a string in a 256-byte buffer, so you check that the string is no longer than 256 characters, but you forget the zero-terminator, and you have a buffer overflow. Or maybe you properly limited the string to 255 characters, but along the way, you added support for multibyte characters, and you get another buffer overflow. Bound checking would have caught that. Injection can happen at any point. You may sanitize user input to avoid SQL injection, but at some later point it may get out of the database and in a format string, but it was sanitized for SQL, not for format strings, leading to a potential injection.