>- sanitizing input

Oh, that unicorn that everybody takes about, yet nobody does anything with it

So, how do you sanitize input?

you save in database escaped strings?

allow only "english" letters?

>- HTML injection

>- XSS

those two belong to

>- Escaping output

don't they?

>- Various timing attacks (eg password hashing)

>- How to store passwords

just use state of art auth/login handling libs?

>- DDoS and other resource exhaustion attacks

I don't think I'd add it there, isn't it handled by firewall / infrastructure than app directly?