[outworlder]

Not the input, the output. There are some good comments on this thread about the distinction.

Case in point: the owner altered the vehicle's name using the vehicle's own UI (which is probably not browser based). That input gets stored in the database. Then another system, web-based, wants to display it. If you don't encode the output, you'll be exposed.

Never trust that the input is properly encoded. HTML encode it before display, always.

[Someone1234]

This pedantism only makes sense if you stop reading five words in, ignore the rest of that same sentence, and ignore the context.

I'm not going to address it because it wasn't made in good faith and adds no value to the actual (rather than imagined) discussion.

[indium21]

> pedantism

Sorry, I can't help myself: pedantry