Revisiting the code slices of the example
applications after they have been
brought into adherence with the coding
guideline shows (figures 2a–2c)
that uses of injection-prone data sinks
have been replaced with corresponding
inherently safe APIs in (1'), (5'),
(9') and (10’). Now, none of these code
snippets can result in an XSS bug, and
neither they nor their fan-in need to
be inspected during a security review.