1. A computer-implemented method comprising: receiving an instrumented web application including at least one special code marker, the at least one special code marker identifying a sanitizer with an untrusted input; identifying a browser parsing context for the untrusted input, the browser parsing context associated with a state of a web browser when the web browser is parsing at a point where the untrusted input is rendered in an output stream; checking if the sanitizer matches the browser parsing context for the untrusted input; when the sanitizer does not match the browsing parsing context of the untrusted input, tagging an execution trace of the untrusted input to an output stream as a violating path, the violating path representing a path through the uninstrumented web application taken by the untrusted input that leads to outputting the untrusted input in an output stream; and generating a correct sanitizer sequence for application to the untrusted input when the uninstrumented web application executes along the violating path.