Properly sanitize or escape all user-provided inputs before using them in sensitive contexts to prevent injection attacks. This applies to multiple contexts:
1. **SQL/OData queries**: Use parameterized queries or properly escape special characters:
```diff
-request = request.filter(`contains(subject, '${query}')`);
+const escapedQuery = query.replace(/'/g, "''");
+request = request.filter(`contains(subject, '${escapedQuery}')`);
```
2. **HTML content**: Use a library like DOMPurify to sanitize HTML before rendering:
```diff
-return `${latestReplyHtml}
`;
+return DOMPurify.sanitize(`${latestReplyHtml}
`);
```
3. **XML construction**: Escape special characters in XML:
```diff
-${rule.name}
+${escape(rule.name)}
```
4. **AI prompts**: Sanitize inputs before inclusion in prompts:
```diff
-${user.about ? `${user.about}` : ""}
+${user.about ? `${sanitizeText(user.about)}` : ""}
```
Input sanitization is your first line of defense against injection vulnerabilities and should be applied consistently throughout your codebase.