alt Hacker NewsThis is pretty cool, but at the same time i'm horrified that somebody might walk away thinking you need to deny these requests to protect against XSS or SQL injection.
Maybe i want to sell coffee mugs with `<img src=x onerror=alert(document.domain)>` on them.
Parse, dont validate. (And never interpret what shouldn't be)
Though in this case, it would be: escape, don't sanitize. "Parse, don't validate" applies to taking inputs; this is about generating outputs (like SQL queries or HTML markup).