1. A computer-implemented method comprising: receiving an instrumented web application including at least one special code marker, the at least one special code marker identifying a sanitizer with an untrusted input; identifying a browser parsing context for the untrusted input; checking if the sanitizer matches the browser parsing context for the untrusted input; when the sanitizer does not match the browsing context, tagging an execution trace associated with the untrusted input as a violating path, the execution trace including a path through the web application taken by the untrusted input that leads to outputting the untrusted input in an output stream; and generating a correct sanitizer sequence for the untrusted input.