“The devil's in the details though because encoding the data is not as simple as it seems because sometimes you have to use HTML encoding, sometimes you have to use HTML attribute encoding, sometimes you have to use JavaScript escaping.”

Transcript evidence from Dave Ferguson -- The OWASP Top 10 Proactive Controls.