[drdaeman]

As I get it, inputs aren’t an issue, failure to correctly escape outputs to match the target format is.

[hnick]

I liked perl's taint mode. It seemed pretty good against the "oops, forgot to sanitise this and you used it as output" situation that probably accounts for a lot of these issues. It won't force you to correctly sanitise, but assuming you have that capability it lets you know about gaps so you can plug them.

[paulryanrogers]

Good point, both are needed: secure parsing and secure rendering.