> It's an exploit mitigation strategy, not a sound way of actually preventing bugs. Actually it is a simple and effective way to prevent general bugs. If you

> It's an exploit mitigation strategy, not a sound way of actually preventing bugs. Actually it is a simple and effective way to prevent general bugs. If you have an input field called birthday, you can inject it directly into your database. Doing that could cause an SQL injection exploit, so people use prepared statements. But even if you use prepared statements, you'll still end up with a database column with all kinds of birthday formatting (M-D-Y, Y-M-D, slashes, spaces, colons, etc etc). These different, non-standard formats will eventually cause a bug. Input sanitization forces you to standardize on one birthday format, and inject it into your database in one format (let's say "YYYY-MM-DD", no other characters allowed). Then all the code expects - and gets - one format. This reduces bugs from unexpected formats. It has the added side-effect of also eliminating the SQL injection bug, regardless of prepared statement.