Input Validation Alone Does Not Prevent XSS

Input validation is important, but it is not enough to prevent cross-site scripting. Data may satisfy every input rule and still become dangerous when rendered unsafely into HTML, JavaScript, or a URL context.

The primary defense is context-aware output escaping and avoiding untrusted data in dangerous positions. Content Security Policy adds a layer that can reduce the impact of some injection cases, but it does not replace safe rendering.

Treat all user-controlled data as untrusted even after validation, including links, files, and values written directly to the DOM. Test output paths as well as input forms, and use the framework's safe defaults instead of disabling escaping without a documented reason.