Let's stop calling it "Sanitization". ---- The issue isn't that the strings are dirty, and you're removing the dirt. After all, turning "<" into "\<" hasn't removed the objectionable material, it's just transformed it. Made it dirtier, even. ---- The issue is that you want to *let the bad thoughts out* of the string. ---- ";--\ndrop table users;--" isn't dirt; it's an active evil, a demon. You want to get it out of your string by making a little hole near the ";" to let it out. You're trepanning the string. ---- The nice thing about this metaphor is that in addition to being a more accurate description of what you're doing, it's also a great metaphor about the *kind of people who think that this is a good idea*, as well as the *state of the practice of technology* that they are familiar with. ---- Hopefully the next time you see a PHP developer headed for your inputs with some backslashes and extra quotes, you'll have a clear mental picture of a concerned-looking medieval physician headed for you with a nice, sharp corkscrew. React accordingly.