There is one habit that closes most cross-site scripting holes in a server-rendered application, and it is boring: escape at the point of output, every time, with no exceptions you have to remember. Which function, for which context, and why late beats early.

Escaping Everything You Echo

There is one habit that closes most cross-site scripting holes in a server-rendered application, and it is boring: escape at the point of output, every time, with no exceptions you have to remember.