All injection attacks are successful because the web application fails to properly sanitize user input. What do we mean when we say that input needs to be sanitized (i.e., what is a web application that is sanitizing input doing?)

When we say that input needs to be sanitized in the context of a web application, we are referring to the process of cleaning or filtering the input data. The main purpose of sanitizing input is to prevent malicious data from causing harm to the system, database, or users.

Here are the steps a web application takes to sanitize input:

1. Validation: The application checks if the input data is in the expected format. For example, if a form field expects an email address, the application checks if the input data indeed looks like an email address.

2. Escaping: The application makes potentially harmful characters in the input data safe. For example, characters that are part of SQL commands or script tags could be escaped so they are treated as regular text and not as code.

3. Canonicalization: The application converts data that can be represented in multiple ways to a "standard" representation. This can help catch input that is trying to use unusual representations to sneak past other sanitization steps.

4. Least Privilege: The application only allows each piece of code to access the resources (like files or database tables) that it absolutely needs to. This can limit the harm that can be done if an injection attack does succeed.

By sanitizing input, a web application can protect itself from injection attacks and other forms of malicious input.