Stop telling people to sanitize user input

A strong argument against the common advice to 'sanitize user input', explaining the important distinction between sanitization and validation. Sanitization modifies data based on assumed intent, risking data loss and misinterpretation, while validation checks that input meets defined requirements without altering it. The correct approach is to validate input, reject non-conforming data, use prepared statements to prevent SQL injection, and encode/escape data at the point of use — not at the point of storage. Client-side validation is also insufficient for security since it can always be bypassed.