for preventing XSS, although input validation may provide some defense-in-depth.
This is because it effectively limits what will appear in output. Input validation will not
always prevent XSS, especially if you are required to support free-form text fields that
could contain arbitrary characters. For example, in a chat application, the heart emoticon