title: Why so much HTML input sanitization necessary?
body: <p>I have implemented a search engine in C for my html website. My entire web is programmed in C.</p>
  
  <p>I understand that html input sanitization is necessary because an attacker can input these 2 html snippets into my search page to trick my search page into downloading and displaying foreign images/scripts (XSS):</p>
  
  <pre><code>&lt;img src="path-to-attack-site"/&gt;
  &lt;script&gt;...xss-code-here...&lt;/script&gt;
  </code></pre>
  
  <p>Wouldn't these attacks be prevented simply by searching for '&lt;' and '>' and stripping them from the search query ? Wouldn't that render both scripts useless since they would not be considered html ? I've seen html filtering that goes way beyond this where they filter absolutely all the JavaScript commands and html markup !</p>