[xxs]

I have never sanitized any input, full respect to whatever text there is.

It's simple - html/xml/javascript/json/url is not text. You render it with whatever tools you have to - and that tools happen not to be concat. You render xml - use DOM, xslt, etc. html - same story, use whatever templating engine you wish. json - use your own model and render it to json. SQL - prepared statements.

[zelphirkalt]

I think this misses important aspects. One does not often want to render HTML in place of a user name on a website as HTML, for example.