Interview prompt
Explain treat browser input as data at every boundary to an engineer who understands the surrounding system but has not used this technique. Walk from its contract to a concrete operation, then discuss where it fails or becomes expensive.
A strong answer
Browser security depends on keeping untrusted data from becoming executable code or changing the meaning of a command. Validation checks whether data fits an expected shape; context-aware output encoding ensures text is interpreted as text in HTML, an attribute, a URL, or JavaScript.
If a comment is stored and later placed into a page, escaping it for the correct HTML context prevents markup from becoming active. A Content Security Policy can reduce some exploit paths, but it does not replace safe templating. Server-side validation remains necessary because clients can be bypassed.
A complete answer also calls out the assumptions that control correctness. Input filtering by searching for a few dangerous strings is fragile because parsers accept many equivalent forms. SQL parameters, HTML output encoding, URL validation, and shell argument handling solve different boundary problems. Use the control designed for the interpreter that will consume the value.
Close by describing one representative test or measurement. A search term is inserted into both an HTML heading and a query selector. Explain why one escaping function should not automatically be reused for both contexts.
Follow-up questions
Answer the follow-ups in the frontmatter. Use the linked article for the concept and the trace to make the explanation concrete.