Determining when or when to not infer

Question

I have a page where I have about 90 elements that I need to display. Most of them are object properties (I use ORM so that these objects appear in my database tables). But the question is, should I code each of these 90 outputs, applying functions to each (in my case, to htmlspecialchars)? Wouldn't that add a bit of overhead (calling one function 90 times)?

EDIT: term "output coding" ... hehe

Answer 1

Someone at some point is entering data that can ruin your HTML page. They can do this by accident (the company name has a ">" in it) or intentionally (see XSS ).

So yes, always code the output correctly.