Failure to Sanitize Paired Delimiters

Paired delimiters are fundamental to programming syntax, marking the start and end of code blocks, strings, or data elements. Common examples include angle brackets (< >) for tags, parentheses ( ) for functions, braces { } for blocks, square brackets [ ] for arrays, and single or double quotes for strings. When an application doesn't sanitize these user-controlled delimiter pairs, it can misinterpret where a command or data block ends, leading to critical security flaws like injection attacks or logic errors. For developers, the fix involves implementing strict input validation and context-aware output encoding. Always treat any user input containing these special characters as untrusted. Use well-established sanitization libraries for your specific context (e.g., HTML, SQL, OS commands) instead of writing custom filters, as correctly handling nested or escaped delimiters is error-prone. This ensures the application correctly interprets delimiter pairs as literal data, not as executable code or structural syntax.