Comment by tomjen3
2 days ago
We have come to a consensus. That is, A, you use the raw input right up till the very last second that you can and B you use the technology specific escaping APIs.
In the case of writing to the DOM, that means you use .innerText rather than .innerHTML. In the case of writing to a database, that means you use the driver and insert variables rather than directly into the string. Both of these are technology-specific escaping APIs. It's just that the browser is much better at making sure HTML is passed safely than you are.
> In the case of writing to the DOM, that means you use .innerText rather than .innerHTML.
This is even enforceable with Trusted Types.