Comment by krapp

Yeah, escaping entities when rendering, using prepared statements in the database. It's not rocket science.