headerlink" href="#the-config-global-xss-filtering-setting" title="Permalink to this headline">¶</a></h3>
<p>As already explained above, XSS filtering should not be done on input data,
but on output instead. Therefore, the <code class="docutils literal"><span class="pre">$config['global_xss_filtering']</span></code>,
which automatically filters <em>input</em> data, is considered a bad practice and
is now deprecated.</p>
<p>Instead, you should manually escape any user-provided data via the
<a class="referen