In the case of SQL-insertion attacks, santizing the data is one approach – but it’s tedious and error prone, and often leaks back to the user (“sorry Mr O’Darn, but quotes are not allowed!”). A far better approach is to use parameter markers in the SQL (“update table set name = ? where key = ?”) and then the entire issue goes away. As does floating-point precision. And date/time formatting. And performance goes up! (except possibly in Java, but that says more about Java than about SQL).

Problem is, there’s really no way to do this ‘right’ with HTML! For this reason, I think HTML is fundamentally flawed – there’s no systemic way to do it right which would solve it once and for all; the best you can do is keep patching system after system for exploit after exploit ad infinitum.

I always sanitise input that actually does anything, but I’m not sure if I have been careful enough sanitising input that could be abused in the same way as you described.

Thanks