Web Security · Middle · Question 9 of 75
Why is "sanitize on input, store the clean version" less reliable than encoding on output?
- ✓Correct answer: The same data can end up in different contexts later (HTML, attribute, JSON, CSV), and each needs its own encoding
- 2Because databases can't store HTML
- 3Because input sanitization is slower
Explanation
Validate input for format, but encode at the point of output for the exact context. That works even for data that arrived through other channels.