This trace follows the actual state transitions behind the companion Treat Browser Input as Data at Every Boundary. It describes a common execution path; implementation details can vary, so keep the contract separate from the mechanism.
Step 1: Receive untrusted input
Browser security depends on keeping untrusted data from becoming executable code or changing the meaning of a command. Validation checks whether data fits an expected shape; context-aware output encoding ensures text is interpreted as text in HTML, an attribute, a URL, or JavaScript.
Step 2: Validate the expected shape
If a comment is stored and later placed into a page, escaping it for the correct HTML context prevents markup from becoming active. A Content Security Policy can reduce some exploit paths, but it does not replace safe templating. Server-side validation remains necessary because clients can be bypassed.
Step 3: Encode for output context
Escape a value for the interpreter that will consume it: HTML text, an attribute, a URL, and JavaScript are distinct contexts with different rules.
At this point, record the state that changed and check the invariant before advancing. If the operation repeats, make clear which values persist and which are recomputed.
Step 4: Render as data
Input filtering by searching for a few dangerous strings is fragile because parsers accept many equivalent forms. SQL parameters, HTML output encoding, URL validation, and shell argument handling solve different boundary problems. Use the control designed for the interpreter that will consume the value.
Step 5: Apply defense-in-depth policy
A search term is inserted into both an HTML heading and a query selector. Explain why one escaping function should not automatically be reused for both contexts.
The trace is complete when the result satisfies the stated contract. Compare this model with the concrete runtime or system you are studying before making a performance claim.