alt Hacker NewsThough in this case, it would be: escape, don't sanitize. "Parse, don't validate" applies to taking inputs; this is about generating outputs (like SQL queries or HTML markup).
Though in this case, it would be: escape, don't sanitize. "Parse, don't validate" applies to taking inputs; this is about generating outputs (like SQL queries or HTML markup).
Yes, I believe the term is "output encoding"