Sanitize on input, escape on output: the WordPress rule behind XSS

This is the first post in a series about the security of AI-generated WordPress code: not how people write plugins, but what a coding assistant hands back when you ask it for one, and whether that out