e-of-the-xss-clean-form-validation-rule" title="Permalink to this headline">¶</a></h2>
<p>A largely unknown rule about XSS cleaning is that it should <em>only be
applied to output</em>, as opposed to input data.</p>
<p>We’ve made that mistake ourselves with our automatic and global XSS cleaning
feature (see previous step about XSS above), so now in an effort to discourage that
practice, we’re also removing ‘xss_clean’ from the officially supported
list of <a class="reference internal" href="../libr