> Never emit contents of any variable to the browser without treating it with htmlspecialchars() (or equivalent) first.

That seems like one way of using a sledgehammer to needlessly burn server-side CPU cycles.