I am confused with the using of both "Contextual Escaping" and "Sanitizing". I test both and get same result.
$strUrlName = $this->request->getPost('urlName', 'string'); // Value </title><script>alert(1)</script>
echo $strUrlName;
echo "<br>=========================<br>";
$strUrlName =’</title><script>alert(1)</script>’; //
$objEscape = new Phalcon\Escaper();
echo $objEscape->escapeHtml($strUrlName);
OUTPUT :------
alert(1)
=========================
alert(1)
Is there any difference and how & when to use them?