I don't see how sanitizing inputs is a bad thing other than additional work, but considering how much dev time gets wasted, I don't think it's a lot to ask.

Multiple layers. Tight code, sanitized inputs, guardrails, etc.

edit: OH YEAH AND ERROR MESSAGES WITH MORE THAN THE FUCKING USELESS,

"An error has occurred. Contact your Systems Admin, so he can be confused too, because we provided fuck all in diagnostic info in the error message!"