1. A computer-implemented method for sanitizing data in a web application, the method comprising: providing at least one execution trace of the web application that outputs in an output stream an untrusted input, the execution trace having a sanitizer sequence that sanitizes the untrusted input; discovering a mismatch of the sanitizer sequence with a browser parsing context, the browser parsing context corresponding to a portion of the output stream that contains the untrusted input; and determining a correct sanitizer sequence to apply to the untrusted input.