Get the latest tech news
Don’t try to sanitize input, escape output (2020)
Why you should escape output correctly, but generally not sanitize user input.
A website is vulnerable to cross-site scripting (XSS) attacks if users can enter information that the site repeats back to them verbatim in a page’s HTML. This might cause minor issues (HTML that breaks the page layout) or major ones (JavaScript that sends the user’s login cookie to an attacker’s site). In these cases you’re best off using a proper SQL parser ( like this one) to ensure it’s a well-formed SELECT query – but doing this correctly is not trivial, so be sure to get security review.
Or read this on Hacker News