title: HTML/XSS escape on input vs output
body: <p>From everything I've seen, it seems like the convention for escaping html on user-entered content (for the purposes of preventing XSS) is to do it when rendering content.  Most templating languages seem to do it by default, and I've come across things like <a href="https://stackoverflow.com/questions/792974/how-to-escape-html-in-jsp-before-saving-to-database">this stackoverflow answer</a> arguing that this logic is the job of the presentation layer.</p>
  <p>So my question is, why is this the case?  To me it seems cleaner to escape on input (i.e. form or model validation) so you can work under the assumption that anything in the database is safe to display on a page, for the following reasons:</p>
  <ol>
  <li><p>Variety of output formats - for a modern web app, you may be using a combination of server-side html rendering, a JavaScript web app using AJAX/JSON, and mobile app that receives JSON (and which may or may not have some webviews, which may be JavaScript apps or server-rendered html).  So you have to deal with html escaping all over the place.  But input will always get instantiated as a model (and validated) before being saved to db, and your models can all inherit from the same base class.</p>
  </li>
  <li><p>You already have to be careful about input to prevent code-injection attacks (granted this is usually abstracted to the ORM or db cursor, but still), so why not also worry about html escaping here so you don't have to worry about anything security-related on output?</p>
  </li>
  </ol>
  <p>I would love to hear the arguments as to why html escaping on page render is preferred</p>